1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
openc3-vue-common
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting openc3-vue-common, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-gvf2-2rh5-mpgf | High | OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget## Summary A user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON` widget. The `BUTTON` widget **`eval()`s the stored button text in the browser** when the button is activated, and screens are **shared content rendered to other users in the scope**. As a result, an attacker's stored JavaScript executes **in a different operator's authenticated session** — a **stored, cross-user XSS** (not self-XSS). The payload runs in the COSMOS origin and can read `localStorage.openc3Token` (the victim's session token), enabling **session/account takeove |
| GitHub (opens in a new tab) |
- GHSA-gvf2-2rh5-mpgfHighOpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
>= 5.0.6, < 7.3.0
## Summary A user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON` widget. The `BUTTON` widget **`eval()`s the stored button text in the browser** when the button is activated, and screens are **shared content rendered to other users in the scope**. As a result, an attacker's stored JavaScript executes **in a different operator's authenticated session** — a **stored, cross-user XSS** (not self-XSS). The payload runs in the COSMOS origin and can read `localStorage.openc3Token` (the victim's session token), enabling **session/account takeove
CVE: CVE-2026-77394