Open-source package vulnerability · RubyGems

CVE-2025-68271: openc3-api Vulnerable to Unauthenticated Remote Code Execution

criticalCVSS 3.1 10.0GHSA-w757-4qv9-mghp

Summary OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#converttovalue. For array-like inputs, converttovalue executes eval().

Published Jan 13, 2026 · Updated Jan 14, 2026

Affected packages

openc3

Ecosystem: RubyGems
Affected: >= 5.0.6, < 6.10.2
Fixed in: 6.10.2
Check: bundle info openc3

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#convert_to_value. For array-like inputs, convert_to_value executes eval().

Because the cmd code path parses the command string before calling authorize(), an unauthenticated attacker can trigger Ruby code execution even though the request ultimately fails authorization (401).

Credited to GhostPowerShell.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More RubyGems vulnerabilities

All RubyGems entries