CVE-2026-55549

Yamcs prior to versions 5.12.8 and 5.13.2 has a vulnerability in LikeExpression.fillCode_getValueReturn where a LIKE pattern is not properly escaped and is inserted into Java source compiled by SimpleCompiler.cook. The pattern can originate from various API endpoints, and a quote in the pattern can inject Java that runs as the Yamcs server process.

Yamcs prior to versions 5.12.8 and 5.13.2 inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Successful exploitation executes commands as the Yamcs service account.

Yamcs before versions 5.12.8 and 5.13.2 allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source. Via the POST /api/archive/{instance}:executeSql endpoint, arbitrary Java code can be executed in the Yamcs server process, potentially exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

A vulnerability in Yamcs before version 5.12.7 allows an authenticated user with ChangeMissionDatabase privilege to achieve remote code execution by overriding Python algorithms in the Jython script engine. Lack of sandboxing enables importing and executing arbitrary Java classes, including java.lang.Runtime.

In Yamcs before version 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text was constructed without a ClassFilter, allowing a user with ChangeMissionDatabase privilege to override an algorithm and supply JavaScript that reaches arbitrary Java classes to execute arbitrary OS commands. In the default configuration with no security.yaml, the built-in guest user has superuser=true, making the issue reachable without authentication.

Yamcs before version 5.12.7 has a server-side code injection vulnerability in the algorithm evaluation engine. An authenticated user with ChangeMissionDatabase privilege can override an existing algorithm via the REST API and inject Java code, leading to remote code execution on the host.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs prior to 5.11.13 contains a vulnerability in StaticFileHandler.locateFile, which resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

Yamcs before versions 5.12.8 and 5.13.2 omits SystemPrivilege.ControlAccess checks in IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings.

Yamcs before versions 5.12.8 and 5.13.2 fails to enforce privileges required by equivalent REST endpoints in WebSocket subscription handlers. Specifically, subscriptions to packets, algorithm status, and mission database changes are available without required privileges, allowing low-privilege users to receive sensitive data.