Medium severity6.1NVD Advisory· Published Oct 2, 2024· Updated Jun 17, 2026
CVE-2024-43795
CVE-2024-43795
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openc3RubyGems | < 5.19.0 | 5.19.0 |
@openc3/tool-commonnpm | < 5.19.0 | 5.19.0 |
openc3PyPI | < 5.19.0 | 5.19.0 |
Affected products
5- ghsa-coords3 versions
< 5.19.0+ 2 more
- (no CPE)range: < 5.19.0
- (no CPE)range: < 5.19.0
- (no CPE)range: < 5.19.0
Patches
Vulnerability mechanics
References
7- github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576envdPatchWEB
- github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9gnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-vfj8-5pj7-2f9gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-43795ghsaADVISORY
- securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOSnvdADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-100.yamlghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2024-43795.ymlghsaWEB
News mentions
0No linked articles in our index yet.