CVE-2026-46621
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A vulnerability in Yamcs before version 5.12.7 allows an authenticated user with ChangeMissionDatabase privilege to achieve remote code execution by overriding Python algorithms in the Jython script engine. Lack of sandboxing enables importing and executing arbitrary Java classes, including java.lang.Runtime.
Risk Assessment
An attacker can gain full control over the host operating system, leading to complete compromise of mission control infrastructure and potential data loss or service disruption.
Recommendation
Upgrade Yamcs to version 5.12.7 or 5.13.0 immediately, which disable algorithm editing by default. Additionally, restrict REST API access to trusted users only.
Original NVD description (English source)
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.