CVE-2026-55565
CriticalCVSS 9.9Summary
Yamcs prior to versions 5.12.8 and 5.13.2 has a vulnerability in LikeExpression.fillCode_getValueReturn where a LIKE pattern is not properly escaped and is inserted into Java source compiled by SimpleCompiler.cook. The pattern can originate from various API endpoints, and a quote in the pattern can inject Java that runs as the Yamcs server process.
Risk Assessment
The risk includes remote code execution in the server context, potentially leading to full system compromise and data security breach.
Recommendation
It is recommended to immediately update Yamcs to versions 5.12.8 or 5.13.2, which contain the fix.
Original NVD description (English source)
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.