CVE-2026-77602 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-77602 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-77602 is a critical remote code execution issue in rubygems openc3 (COSMOS), CVSS 9.9. An authenticated user can write attacker-controlled files into the user-writable targets_modified/ overlay, and COSMOS then treats those files as code in multiple paths: ERB rendering, generic conversion blocks, and Script Runner suite analysis. In practice, this can lead to arbitrary code execution inside the cmd-tlm-api container, target decom/microservices, and the script-runner process.

Not currently known to be exploited in the wild and not in CISA KEV, but the impact is severe enough that solo developers and small teams should treat this as an urgent patch-and-contain event.

Immediate Action

  • Upgrade immediately to the first fixed openc3 release: TODO: fixed_version or later. If you cannot patch today, isolate the COSMOS host/container and restrict access to authenticated users only.
  • Disable or restrict write paths to targets_modified/, especially screen save and storage upload endpoints, until patched.
  • Assume code execution is possible if any non-admin authenticated user had access to COSMOS. Review recent changes under targets_modified/ and unexpected target/procedure files.
  • Rotate secrets used by COSMOS services, including Redis and bucket credentials, after patching.
  • See vendor guidance if available: vendor advisory.

Affected Versions

  • rubygems/openc3@<= TODO: vulnerable_version vulnerable
  • rubygems/openc3@TODO: fixed_version+ safe
  • Python implementation in the same release line is also affected where it mirrors the target-file and conversion logic

Resolution Guide

Preferred fix: upgrade COSMOS/openc3 to the patched release. If you deploy via Docker, pin the fixed image tag; if you use a gem, update the gem and rebuild.

# Ruby/Bundler
bundle update openc3
bundle exec ruby -e 'puts Gem.loaded_specs["openc3"].version'

# If installed as a gem
gem update openc3

# Docker Compose: pin to a patched image tag
# TODO: replace with fixed tag
image: openc3/openc3:TODO-fixed-tag

# Docker pull example
docker pull openc3/openc3:TODO-fixed-tag

Python environment (if you use the mirrored Python package):

# pip
pip install --upgrade openc3==TODO:fixed_version

# pipx
pipx upgrade openc3

JavaScript / Java / Linux package managers are unlikely to apply directly to COSMOS itself, but if you wrap it in tooling, update the wrapper and lockfiles accordingly:

# npm / yarn / pnpm examples for wrapper packages
npm i openc3@TODO:fixed_version
yarn add openc3@TODO:fixed_version
pnpm add openc3@TODO:fixed_version

# Maven / Gradle if you consume a published artifact
# TODO: replace coordinates with your actual dependency
mvn versions:use-dep-version -Dincludes=TODO:group:artifact -DdepVersion=TODO:fixed_version
./gradlew dependencies

# Debian/Ubuntu or RHEL-based systems if packaged internally
apt-get update && apt-get install --only-upgrade openc3
yum update openc3

Hardening until patched:

# Block write access to overlay paths at the filesystem or object-store layer
chmod -R a-w /path/to/targets_modified

# If using Docker, mount the overlay read-only where possible
# TODO: adapt to your compose file
volumes:
  - ./targets:/app/targets:ro
  - ./targets_modified:/app/targets_modified:ro

Minimal code fix direction (for maintainers): ensure code-execution paths never parse from targets_modified/ with ERB enabled, and require higher authorization for suite analysis and overlay writes.

# Pseudocode patch idea
def body(name, run_erb: false)
  read_only = read_from_targets(name)
  overlay = read_from_targets_modified(name)
  parse(read_only || overlay, run_erb: false)
end

# Gate suite analysis behind script_run
authorize("script_run")

Detection & Verification

Check your installed version:

bundle exec ruby -e 'require "openc3"; puts Gem.loaded_specs["openc3"].version'
gem list openc3
docker image inspect openc3/openc3:TAG --format '{{.RepoTags}}'

Look for risky code paths in your deployment:

grep -R "targets_modified" -n .
grep -R "ERB.new" -n openc3
grep -R "eval(@code_to_eval)\|exec(\|require ARGV" -n openc3

Verify the fix:

  • Confirm requests that write to targets_modified/ are denied for non-admin users.
  • Confirm table generation and suite analysis no longer execute content from the overlay as code.
  • Re-run your normal COSMOS workflows and ensure they still function with trusted files in the read-only targets/ tree.
# Example sanity check after patch
curl -i -X POST "$BASE/tables/generate" \
  -H "Authorization: $TOKEN" \
  --data-urlencode 'definition=INST/screens/poc.txt'
# Expected: no code execution, and overlay content should not be treated as executable input

Risk and Impact

This bug can give an attacker arbitrary code execution as the openc3 service user inside COSMOS containers and microservices. That user typically has access to internal service credentials, Redis, and bucket storage, so compromise can spread beyond one endpoint into telemetry, command, and configuration data.

For small teams, the blast radius is especially high because COSMOS often runs with broad internal trust and limited segmentation. Even if the web UI is only exposed locally, any authenticated user with access to the instance may be able to trigger the vulnerable paths.

Keep reading