Description
A user who can save a telemetry screen (permission system_set) can embed JavaScript in a screen BUTTON widget. The BUTTON widget eval()s the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope.
Recommendation
Update the @openc3/vue-common package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.6, <= 7.2.1
- Patched version(s): 7.3.0
References
Could your website be exposed too?
SmartScanner can check your website for OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
- Fabric.js Affected by Stored XSS via SVG Export - CVE-2026-27013
You might also like:
See something that needs correcting? Let us knowUpdated September 23, 2026