The vulnerability allows a well‑authenticated actor to inject shell metacharacters into the custom pypi_url setting. During plugin installation, the setting value is directly interpolated into a shell command, giving the attacker the ability to execute arbitrary operating‑system commands with the privileges of the openc3 service user. This can lead to disclosure of Redis credentials and bucket secrets, and ultimately full compromise of the host running openc3.

OpenC3 COSMOS products between versions 5.12.0 and 7.3.0 are affected. In open‑source deployments any authenticated user can reach the vulnerable API, while in Enterprise deployments only administrators can perform the action.

The CVSS score of 8.8 indicates a high severity level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication to write the pypi_url setting, the attacker must possess valid credentials and be able to call the authenticated POST /openc3-api/api endpoint. Once the payload is stored, installation of a plugin with Python dependency metadata triggers the vulnerable shell command, leading to remote code execution. Without the need for network traversal or interaction with external services, the exploitation path is relatively straightforward for anyone who can obtain user credentials.