CVE-2026-42087 — AI Deep Analysis Summary

🚨 **Essence**: A SQL Injection (SQLi) flaw in OpenC3 COSMOS's TSDB component. 💥 **Consequences**: Attackers can bypass SQL logic, execute arbitrary commands, and even **delete critical data** from the QuestDB database.

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The `tsdb_lookup` function in `cvv_model.rb` fails to sanitize user input.…

📦 **Affected**: OpenC3 COSMOS. 📅 **Versions**: From **6.7.0** up to (but not including) **7.0.0-rc3**. 📍 **Component**: The Time Series Database (TSDB) integration with QuestDB.

💀 **Capabilities**: Full SQL command execution. 🗑️ **Impact**: Attackers can read, modify, or **delete** database records. 📉 **Severity**: High integrity and confidentiality loss due to potential data destruction.

🔑 **Threshold**: **Low**. Requires **Low Privilege** (PR:L) network access (AV:N, AC:L). 🚪 **Entry**: No user interaction needed (UI:N).…

🕵️ **Exploit Status**: **No public PoC/Exploit** listed in the data. 📂 **References**: Only vendor advisories and commit links are provided.…

🔍 **Self-Check**: Scan for OpenC3 COSMOS instances running versions **6.7.0 - 7.0.0-rc2**. 📡 **Focus**: Check the TSDB/QuestDB interface endpoints for SQL injection points in the `cvv_model.rb` logic.…

✅ **Fixed**: Yes! 🩹 **Patch**: Version **7.0.0-rc3** and later. 🔗 **Source**: See GitHub Release v7.0.0-rc3 and Security Advisory GHSA-v529-vhwc-wfc5 for the fix details.

🚧 **Workaround**: If you cannot upgrade immediately, **restrict network access** to the COSMOS TSDB component.…

🔥 **Priority**: **HIGH**. 🚨 **Reason**: CVSS Score indicates High Confidentiality/Integrity impact. 💾 **Risk**: Data deletion is possible.…