CVE-2026-44632
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Yamcs before version 5.12.7 has a server-side code injection vulnerability in the algorithm evaluation engine. An authenticated user with ChangeMissionDatabase privilege can override an existing algorithm via the REST API and inject Java code, leading to remote code execution on the host.
Risk Assessment
An attacker can gain full control of the host operating system, risking complete compromise of the mission control infrastructure, data loss, and service disruption.
Recommendation
Immediately update Yamcs to version 5.12.7 or 5.13.0. After update, algorithm editing is disabled by default; restrict ChangeMissionDatabase privilege to trusted users only.
Original NVD description (English source)
Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.