CVE-2026-42086 | OpenC3 cosmos up to 6.x Session Token eval cross site scripting (GHSA-ffq5-qpvf-xq7x)

A vulnerability was found in OpenC3 cosmos up to 6.x. It has been rated as problematic. This vulnerability affects the function eval of the component Session Token Handler. The manipulation leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-42086. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is advised.