The tsdb_lookup function in the cvt_model.rb file fails to sanitize user input before embedding it directly into a SQL query. This defect permits an attacker to insert arbitrary SQL, enabling execution of commands such as dropping or deleting tables and manipulating stored data. As a result, the vulnerability can compromise data integrity and confidentiality within the COSMOS time-series database, classified as CWE‑89.

The flaw affects OpenC3 COSMOS versions starting from 6.7.0 up to, but not including, 7.0.0‑rc3. These releases provide the Time‑Series Database component that contains the vulnerable tsdb_lookup helper. The issue was addressed in the 7.0.0‑rc3 release; deploying this patch or any newer version resolves the injection risk.

The CVSS score of 9.6 indicates a high‑severity flaw, and although a current EPSS value is unavailable, the absence of a KEV listing suggests no publicly known exploit yet. The likely attack vector is remote, relying on an attacker’s ability to send crafted requests to the TSDB service; authentication requirements are unclear, so the vulnerability may be exploitable without elevated privileges. Given the severity and potential for data loss, users should treat this as a critical issue warranting immediate attention.