Vulnerability Details CVE-2026-42087
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.0%
CVSS Severity
CVSS v3 Score 9.6
References
Products affected by CVE-2026-42087
-
cpe:2.3:a:openc3:cosmos:6.10.0
-
cpe:2.3:a:openc3:cosmos:6.10.1
-
cpe:2.3:a:openc3:cosmos:6.10.2
-
cpe:2.3:a:openc3:cosmos:6.10.3
-
cpe:2.3:a:openc3:cosmos:6.10.4
-
cpe:2.3:a:openc3:cosmos:6.10.5
-
cpe:2.3:a:openc3:cosmos:6.10.6
-
cpe:2.3:a:openc3:cosmos:6.7.0
-
cpe:2.3:a:openc3:cosmos:6.8.0
-
cpe:2.3:a:openc3:cosmos:6.8.1
-
cpe:2.3:a:openc3:cosmos:6.9.0
-
cpe:2.3:a:openc3:cosmos:6.9.1
-
cpe:2.3:a:openc3:cosmos:6.9.2
-
cpe:2.3:a:openc3:cosmos:7.0.0