openc3 (PyPI)
Advisories
12
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.0.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "openc3>=7.0.0"poetry
poetry add "openc3>=7.0.0"uv
uv add "openc3>=7.0.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2wvh-87g2-89hr OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool |
High EPSS 0.34% |
< 7.0.0 | 7.0.0 |
| GHSA-v529-vhwc-wfc5 OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database |
Critical EPSS 0.32% |
>= 6.7.0, < 7.0.0 | 7.0.0 |
| GHSA-ffq5-qpvf-xq7x OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender |
Medium EPSS 0.20% |
< 7.0.0 | 7.0.0 |
| GHSA-ffq5-qpvf-xq7x OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender |
Medium EPSS 0.20% |
< 7.0.0 | 7.0.0 |
| GHSA-4jvx-93h3-f45h OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames |
Medium EPSS 0.31% |
< 6.10.5 | 6.10.5 |
| GHSA-wgx6-g857-jjf7 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence |
High EPSS 0.30% |
< 6.10.5 | 6.10.5 |
| GHSA-4xqv-47rm-37mm OpenC3 stores passwords in clear text (`GHSL-2024-129`) |
Medium EPSS 0.35% |
< 5.19.0 | 5.19.0 |
| GHSA-4xqv-47rm-37mm OpenC3 stores passwords in clear text (`GHSL-2024-129`) |
Medium EPSS 0.35% |
< 5.19.0 | 5.19.0 |
| GHSA-8jxr-mccc-mwg8 OpenC3 Path Traversal via screen controller (`GHSL-2024-127`) |
Medium EPSS 0.91% |
< 5.19.0 | 5.19.0 |
| GHSA-8jxr-mccc-mwg8 OpenC3 Path Traversal via screen controller (`GHSL-2024-127`) |
Medium EPSS 0.91% |
< 5.19.0 | 5.19.0 |
| GHSA-vfj8-5pj7-2f9g OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) |
Medium EPSS 0.48% |
< 5.19.0 | 5.19.0 |
| GHSA-vfj8-5pj7-2f9g OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) |
Medium EPSS 0.48% |
< 5.19.0 | 5.19.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor