Skip to main content

Security Vulnerabilities

Below is a list of CVEs reported in COSMOS. This does not include CVEs in our dependencies - you can find those in our Trivy scans.

Patched​

CVEPatched VersionAffected EditionsDescription
CVE-2024-437955.19.0Core onlyXSS exploit in login screen
CVE-2024-469775.19.0Core & EnterprisePath traversal for .txt files via LocalMode's open_local_file function
CVE-2024-475295.19.0Core onlyPlaintext storage of password in browser LocalStorage
CVE-2025-283806.0.2Core & EnterpriseXSS exploit via crafted URLs to the Documentation Tool or via stored screens with the IFRAME widget in Telemetry Viewer
CVE-2025-283816.0.2Core & EnterpriseCertain Docker credentials were leaked through environment variables, readable by authenticated users in Script Runner
CVE-2025-283826.1.0Core & EnterpriseArbitrary file read/copy/delete via the Table Manager API
CVE-2025-283846.1.0Core & EnterpriseArbitrary file read via the Script Runner API
CVE-2025-283886.0.2Core onlyHardcoded credentials for the service account (used by running scripts to access the API - no admin permissions)
CVE-2025-682716.10.2Core & EnterpriseCritical remote code execution vulnerability reachable through the JSON-RPC API by an unauthenticated attacker

Open​

CVEAffected EditionsDescriptionWhy is it still open?
CVE-2025-28386Core & EnterpriseRCE via installing a pluginWon't fix: this is inherent to the functionality of plugins - if plugins couldn't execute code, you couldn't customize COSMOS. Only authenticated users can load code for execution, and in Enterprise that user must have admin permissions.
CVE-2025-28389Core onlyAPI accepts plaintext passwords for authenticationBreaking change: some users depend on this functionality in our API. Anticipate a patch in COSMOS v7.0 (GitHub issue). Note that exploiting this vulnerability still requires brute-forcing the password; it is just generally easier to brute force a plaintext password than a token or hash with the use of dictionary tools.