← Vulnerability feed

Vulnerability record · CVE-2025-28386 · published 13 June 2025

CVE-2025-28386: Openc3 cosmos code injection vulnerability

OOpenc3 · Cosmos

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

9.8 CVSS 3.1 Critical EPSS 1.1% · top 36.6% CWE-94 · Code injection
9.8CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://openc3.com/ Product
https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ ExploitMitigationThird Party Advisory
https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ ExploitMitigationThird Party Advisory

Track CVE-2025-28386 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-28389Openc3 cosmos weak password requirements vulnerabilityWeak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.EPSS 0.60%9.8CVE-2025-28388Openc3 cosmos hard-coded credentials vulnerabilityOpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.EPSS 0.61%9.6CVE-2026-42087Openc3 cosmos sql injection vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before …EPSS 0.45%9.1CVE-2025-28384Openc3 cosmos path traversal vulnerabilityAn issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%8.1CVE-2026-42088Openc3 cosmos execution with unnecessary privileges vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, t…EPSS 0.49%8.1CVE-2026-42084Openc3 cosmos vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and …EPSS 0.44%7.5CVE-2025-28381Openc3 cosmos vulnerabilityA credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.EPSS 0.52%7.5CVE-2025-28382Openc3 cosmos path traversal vulnerabilityAn issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2025-28386), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.