OpenC3 COSMOS used a JavaScript eval() function on array‑like command parameters. This allows a malicious payload supplied through those parameters to be executed in the browser when the command is sent. The resulting self‑XSS vulnerability means an attacker can run arbitrary code within the authenticated session and can read or alter data, including session tokens stored in local storage.

The affected product is OpenC3 COSMOS. All releases prior to 7.0.0 are vulnerable. The vulnerability is fixed in version 7.0.0 and later.

The CVSS score of 4.6 indicates low‑to‑moderate severity. Exploitation requires the attacker to influence the array‑parameter input, typically via phishing or social engineering, and the victim must submit a command. No EPSS score is available, and the issue is not in the CISA KEV catalog. While the impact is confined to the victim’s session, successful exploitation can compromise authenticated data and session integrity, making the risk significant for environments where this interface is exposed to untrusted users.