CVE-2026-42087

Critical

Published: 04/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In versions from 6.7.0 to before 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of OpenC3 COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input, allowing arbitrary SQL commands to be executed.

Risk Assessment

This vulnerability may lead to unauthorized access to data and data deletion, posing a serious threat to data integrity within the organization.

Recommendation

It is recommended to upgrade to version 7.0.0-rc3 or later to mitigate this vulnerability and to implement input sanitization mechanisms in the application.

Original NVD description (English source)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.