OpenC3 COSMOS contains a stored, cross-user cross-site scripting flaw that is triggered when an authenticated actor with system_set permission stores a shared screen containing a BUTTON widget. The widget’s action script is later executed in the context of another operator’s browser session, where it runs under the COSMOS origin and can read the localStorage.openc3Token value. This allows the attacker to steal the victim’s bearer token, perform a full account takeover, and carry out any privileged action with the victim’s credentials. Affected systems are OpenC3 COSMOS releases from 5.0.6 through 7.3.0. The vulnerability is discovered in the POST /openc3-api/screen interface which allows storage of screen configurations, and in the ButtonWidget.vue component that evaluates the widget action. An authenticated user must possess system_set privileges to exploit the flaw. The CVSS score is 7.6, indicating high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires authenticated access with sufficient permissions; once the stored script is invoked, it can read local tokens and impersonate the victim. The permissive content security policy aids execution but is not the root cause. The flaw is fixed starting with version 7.3.0.

The vulnerability affects OpenC3 COSMOS version 5.0.6 through 7.3.0. The affected product is OpenC3 COSMOS, a platform that manages embedded systems. The flaw is present in the POST /openc3-api/screen endpoint and the ButtonWidget.vue component used to evaluate shared screen configurations. Maintaining a version older than 7.3.0 will leave your installation exposed.

The CVSS score of 7.6 indicates a high severity impact. EPSS is currently unavailable, so the precise exploitation likelihood cannot be quantified, but the flaw does not rely on uncommon or advanced attacker skills. The vulnerability is not listed in the CISA KEV catalog. Exploit requires an attacker to be authenticated with system_set privileges to store a screen configuration. Once a victim’s session loads the stored screen and activates the BUTTON widget, the embedded script runs under the COSMOS origin, granting access to localStorage.openc3Token and enabling theft of bearer tokens and subsequent account takeover. The permissive content security policy facilitates execution, but the core root cause is the unvalidated execution of stored widget actions.