PYSEC-2026-2244
Vulnerability from pysec - Published: 2026-05-04 18:16 - Updated: 2026-07-13 05:50
VLAI
Details
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.
Severity
9.6 (Critical)
Impacted products
| Name | purl | openc3 | pkg:pypi/openc3 |
|---|
Aliases
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "openc3",
"purl": "pkg:pypi/openc3"
},
"ranges": [
{
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "7.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.10.0",
"6.10.1",
"6.10.2",
"6.10.3",
"6.10.4",
"6.10.5",
"6.10.6",
"6.7.0",
"6.8.0",
"6.8.1",
"6.9.0",
"6.9.1",
"6.9.2",
"7.0.0rc2",
"7.0.0rc3"
]
}
],
"aliases": [
"CVE-2026-42087",
"GHSA-v529-vhwc-wfc5"
],
"details": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.",
"id": "PYSEC-2026-2244",
"modified": "2026-07-13T05:50:29.656312Z",
"published": "2026-05-04T18:16:30.830Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"
},
{
"type": "FIX",
"url": "https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415"
},
{
"type": "EVIDENCE",
"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
CVE-2026-42087 (GCVE-0-2026-42087)
Vulnerability from cvelistv5 – Published: 2026-05-04 17:18 – Updated: 2026-05-05 12:46
VLAI
EPSS
VEX
Title
OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
Summary
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenC3/cosmos/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OpenC3/cosmos/commit/9ba60c09c… | x_refsource_MISC |
| https://github.com/OpenC3/cosmos/releases/tag/v7.… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42087",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-05T12:46:08.929960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T12:46:14.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cosmos",
"vendor": "OpenC3",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.7.0, \u003c 7.0.0-rc3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T17:18:02.965Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5"
},
{
"name": "https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415"
},
{
"name": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"
}
],
"source": {
"advisory": "GHSA-v529-vhwc-wfc5",
"discovery": "UNKNOWN"
},
"title": "OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42087",
"datePublished": "2026-05-04T17:18:02.965Z",
"dateReserved": "2026-04-23T19:17:30.566Z",
"dateUpdated": "2026-05-05T12:46:14.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-V529-VHWC-WFC5
Vulnerability from github – Published: 2026-04-23 14:12 – Updated: 2026-05-29 21:46
VLAI
Summary
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database
Details
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)
A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.
Figure 1: Source code vulnerable to SQL injection
Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.
Figure 2: Source code showing the required permissions for the get_tlm_values endpoint
Sending a normal request to the endpoint brings back a single array of values for the parameter:
Figure 3: A normal request to the get_tlm_values endpoint
However, sending a specially crafted request within the start_time variable brings back all the data in the database:
Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.
Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:
Figure 6: Example payload dropping the tables
Steps to Reproduce
- Capture a JSON-RPC request to the
get_tlm_valuesendpoint. - Add the
start_timekey to the request body and place the following in the value:
‘ OR 1=1 --
- Retrieve all database data.
Recommendations
• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements
Severity
9.6 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "openc3"
},
"ranges": [
{
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "7.0.0-rc3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42087"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-23T14:12:02Z",
"nvd_published_at": "2026-05-04T18:16:30Z",
"severity": "CRITICAL"
},
"details": "**Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\nAttack type: Authenticated remote\nImpact: Telemetry data disclosure and deletion\nAffected components: openc3-tsdb (QuestDB)**\n\nA SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb` file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. \n \n\u003cimg width=\"940\" height=\"719\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2c2dd294-6192-49d3-b670-fd7b82c05be0\" /\u003e\n\nFigure 1: Source code vulnerable to SQL injection\nAdditionally, the `get_tlm_values` RPC endpoint only requires \u201ctlm\u201d permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.\n \n\u003cimg width=\"940\" height=\"410\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40be7e8d-51f9-442d-bbd7-77c8488a2f78\" /\u003e\n\nFigure 2: Source code showing the required permissions for the `get_tlm_values` endpoint\nSending a normal request to the endpoint brings back a single array of values for the parameter:\n \n\u003cimg width=\"944\" height=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/23678f17-6bdf-41c1-81bc-ace5a8daa7e5\" /\u003e\n\nFigure 3: A normal request to the `get_tlm_values` endpoint\nHowever, sending a specially crafted request within the start_time variable brings back all the data in the database:\n \n\u003cimg width=\"944\" height=\"432\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bd5ecc87-ba9c-43f0-b196-91062b9c395a\" /\u003e\n\nFigure 4: The request and response after sending the SQL injection payload\nThis payload can be modified to executes SQL commands in the TSDB.\n \n\u003cimg width=\"944\" height=\"425\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70c3c88e-9ed6-4542-bfb4-e77abb002c15\" /\u003e\n\nFigure 5: SQL injection used to execute arbitrary SQL command\nThe user can then delete all the historical data in the database:\n \n\u003cimg width=\"944\" height=\"496\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f2dc1fa6-5fe0-4232-867a-a65776f108ee\" /\u003e\n\nFigure 6: Example payload dropping the tables\n###\tSteps to Reproduce\n1.\tCapture a JSON-RPC request to the `get_tlm_values` endpoint.\n2.\tAdd the `start_time` key to the request body and place the following in the value:\n```sql\n\u2018 OR 1=1 --\n```\n3.\tRetrieve all database data.\n###\tRecommendations\n\u2022\tSanitize all user-supplied input before executing it\n\u2022\tUse prepared statements with parameterized queries when executing SQL statements",
"id": "GHSA-v529-vhwc-wfc5",
"modified": "2026-05-29T21:46:48Z",
"published": "2026-04-23T14:12:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42087"
},
{
"type": "WEB",
"url": "https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenC3/cosmos"
},
{
"type": "WEB",
"url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42087.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…