Critical · published January 13, 2026
🚨 A sneaky JSON-RPC request is your gateway to remote code execution—no authentication required! 🔥 Think of it like a restaurant with an open kitchen: anyone can yell orders at the chefs, even if they’re not paying customers. If they know the right phrases, they could whip up something disastrous without ever stepping foot in the place! An attacker could execute arbitrary Ruby code on your system, potentially gaining complete control over it. This is absolutely devastating, as they could manipulate data, disrupt services, or even hijack sensitive information—all through a simple, unauthenticated request!
Think of it like a restaurant with an open kitchen: anyone can yell orders at the chefs, even if they’re not paying customers. If they know the right phrases, they could whip up something disastrous without ever stepping foot in the place! This vulnerability in OpenC3 COSMOS allows an unauthenticated attacker to execute arbitrary Ruby code via the JSON-RPC API by exploiting the String#convert_to_value function, which evaluates attacker-controlled parameter values. This means that even though the request fails authorization, the damage can already be done.
An attacker could execute arbitrary Ruby code on your system, potentially gaining complete control over it. This is absolutely devastating, as they could manipulate data, disrupt services, or even hijack sensitive information—all through a simple, unauthenticated request! Immediately upgrade OpenC3 COSMOS to version 6.10.2 or later to patch this critical vulnerability. Additionally, review your firewall rules and ensure proper API access controls are in place to minimize exposure. You've got this! Just follow these steps and you’ll lock down your system in no time. 🛡️