openc3 (RubyGems)
Advisories
13
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.3.0 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update openc3 # Gemfile: gem "openc3", ">= 7.3.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jjq7-m736-w977 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) |
Critical EPSS 0.72% |
>= 5.1.0, < 7.3.0 | 7.3.0 |
| GHSA-vp3w-52v9-q57f OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting |
High EPSS 0.63% |
>= 5.12.0, < 7.3.0 | 7.3.0 |
| GHSA-2wvh-87g2-89hr OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool |
High EPSS 0.34% |
< 7.0.0-rc3 | 7.0.0-rc3 |
| GHSA-v529-vhwc-wfc5 OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database |
Critical EPSS 0.32% |
>= 6.7.0, < 7.0.0-rc3 | 7.0.0-rc3 |
| GHSA-ffq5-qpvf-xq7x OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender |
Medium EPSS 0.20% |
< 7.0.0 | 7.0.0 |
| GHSA-4jvx-93h3-f45h OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames |
Medium EPSS 0.31% |
< 6.10.5 | 6.10.5 |
| GHSA-4jvx-93h3-f45h OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames |
Medium EPSS 0.31% |
>= 7.0.0.pre.rc1, < 7.0.0-rc3 | 7.0.0-rc3 |
| GHSA-wgx6-g857-jjf7 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence |
High EPSS 0.30% |
>= 7.0.0.pre.rc1, < 7.0.0-rc3 | 7.0.0-rc3 |
| GHSA-wgx6-g857-jjf7 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence |
High EPSS 0.30% |
< 6.10.5 | 6.10.5 |
| GHSA-w757-4qv9-mghp openc3-api Vulnerable to Unauthenticated Remote Code Execution |
Critical EPSS 0.64% |
>= 5.0.6, < 6.10.2 | 6.10.2 |
| GHSA-4xqv-47rm-37mm OpenC3 stores passwords in clear text (`GHSL-2024-129`) |
Medium EPSS 0.35% |
< 5.19.0 | 5.19.0 |
| GHSA-8jxr-mccc-mwg8 OpenC3 Path Traversal via screen controller (`GHSL-2024-127`) |
Medium EPSS 0.91% |
< 5.19.0 | 5.19.0 |
| GHSA-vfj8-5pj7-2f9g OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) |
Medium EPSS 0.48% |
< 5.19.0 | 5.19.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor