What’s Vulnerable › Vulnerabilities

CVE-2026-42087: OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-04 · updated 2026-10-26
• Weakness: CWE-89

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

Affected products

• OpenC3 cosmos: from 6.7.0 before 7.0.0; 7.0.0-rc1, 7.0.0-rc2 — fixed in 7.0.0

How to fix

Upgrade to a fixed version: OpenC3 cosmos 7.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415
• https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5

Get alerted when CVE-2026-42087 or the next vulnerability affects your stack