CVE-2025-68271

Houston, We Have an `eval()`: Pre-Auth RCE in OpenC3 COSMOS

Alon Barad
Alon Barad
Software Engineer

Jan 14, 2026·6 min read·1 visit

Executive Summary (TL;DR)

OpenC3 COSMOS, software used for satellite command and control, was caught using Ruby's `eval()` to parse strings that looked like arrays. Because this parsing happens before authentication checks in the JSON-RPC API, any unauthenticated attacker can send a crafted packet to execute code as the server user. It's literally a case of 'If it looks like an array, execute it.'

A Critical (10.0) pre-authentication Remote Code Execution vulnerability in OpenC3 COSMOS allows attackers to execute arbitrary commands on mission control servers via the JSON-RPC interface. The flaw stems from the insecure use of `eval()` when parsing array-like strings.

Official Patches

OpenC3GitHub Commit fixing the vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score
10.0/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Systems

OpenC3 COSMOS 5.0.0 - 6.10.1Satellite Ground Systems using COSMOSHardware-in-the-loop Test Benches

Affected Versions Detail

Product
Affected Versions
Fixed Version
OpenC3 COSMOS
OpenC3
>= 5.0.0, <= 6.10.16.10.2
AttributeDetail
CWECWE-95 (Eval Injection)
CVSS v3.110.0 (Critical)
Attack VectorNetwork (Pre-Auth)
Affected ComponentString#convert_to_value
LanguageRuby / Python
Exploit ReliabilityHigh (Deterministic)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.006Command and Scripting Interpreter: Python/Ruby
Execution
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. 'eval').

Known Exploits & Detection

TheoryExploit involves sending a JSON-RPC request with a parameter matching /\[.*\]/ containing Ruby system calls.

Vulnerability Timeline

Patch committed to GitHub
2025-12-14
GHSA Advisory Published
2026-01-13

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.