CVE-2026-42087 - Vulnerability Analysis

Overview

OpenC3 COSMOS >= 6.7.0 and < 7.0.0-rc3 contains a SQL injection caused by unsanitized user input in the tsdb_lookup function of the Time-Series Database component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, including data deletion, potentially compromising database integrity and availability.

Mitigation

Update to version 7.0.0-rc3 or later.

References

• https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415
• https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner