Back to overview

CVE-2025-68271

CRITICAL
10.0
CVSS 3.1
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#convert_to_value. For array-like inputs, convert_to_value executes eval(). Because the cmd code path parses the command string before calling authorize(), an unauthenticated attacker can trigger Ruby code execution even though the request ultimately fails authorization (401). This vulnerability is fixed in 6.10.2.

Metadata

CVE ID
CVE-2025-68271
State
PUBLISHED
Assigner
GitHub_M
Reserved
2025-12-16 14:05 UTC
Published
2026-01-13 18:32 UTC
Last updated
2026-01-13 20:00 UTC
Primary CWE
CWE-95
CWE-95: Improper Neutralization of Directives in Dynamically…
Vendor / Product
OpenC3 / cosmos
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
OpenC3 cosmos — >= 5.0.0, < 6.10.2
Weakness (CWE)
CWESourceDescription
CWE-95 cna CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview