Cosmos' developers have published a comprehensive disclosure of a “critical security vulnerability” which was identified last month.