CVE-2026-46562
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In Yamcs before version 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text was constructed without a ClassFilter, allowing a user with ChangeMissionDatabase privilege to override an algorithm and supply JavaScript that reaches arbitrary Java classes to execute arbitrary OS commands. In the default configuration with no security.yaml, the built-in guest user has superuser=true, making the issue reachable without authentication.
Risk Assessment
The organization is at risk of complete compromise of the Yamcs process by an unauthenticated attacker who can execute arbitrary OS commands, leading to loss of confidentiality, integrity, and availability.
Recommendation
Immediately upgrade Yamcs to version 5.12.7 or 5.13.0, which disable algorithm editing by default. Additionally, configure a security.yaml file to restrict the default guest user privileges.
Original NVD description (English source)
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.