Vendor
Authenticated users can achieve arbitrary OS command execution in the OpenC3 COSMOS API via shell metacharacter injection in the pypi_url configuration setting during plugin installation.