CVE-2026-42087

CRITICAL

OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-42087 has a selected CVSS score of 9.6 (critical).

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

cosmos

Browse OpenC3 / cosmos
CVE List>= 6.7.0, < 7.0.0-rc3affected

openc3

Browse RubyGems / openc3
GitHub Advisory6.7.0 to < 7.0.0-rc3 · Fixed in 7.0.0-rc3affected

References

6