AIKIDO-2026-652506

TL;DR

Telemetry Viewer renders telemetry screens whose BUTTON widgets store an action string as the widget's second parameter, and the ButtonWidget passes that string to eval() in the operator's browser when the button is clicked. Because screens render for every operator who opens them, an authenticated user with screen-editing permission can store JavaScript in a button that later runs in another operator's session. The injected code reads the victim's session token from localStorage.openc3Token, enabling session hijacking and, via Script Runner, server-side code execution. The fix runs button code inside an opaque-origin sandbox iframe with no token, cookie, DOM, or network access and proxies privileged actions back to the parent.