CVE-2026-46562: Yamcs Allows Remote Code Execution via Mission Database Algorithm Override

Summary

A vulnerability in Yamcs's Mission Database allows an attacker with ChangeMissionDatabase privilege to execute arbitrary code on the server. This could lead to unauthorized access or data tampering. To mitigate the risk, Yamcs administrators should ensure that the security.yaml file is configured to restrict user privileges and consider implementing additional security measures to prevent remote code execution.

What to do

Update yamcs org.yamcs:yamcs-core to version 5.12.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	yamcs	org.yamcs:yamcs-core	< 5.12.7 Fix: upgrade to 5.12.7
–	yamcs	yamcs	< 5.12.7

Original title

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgor...

Original description

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

ghsa CVSS3.1 9.8

Vulnerability type

CWE-94 Code Injection

CWE-95

CWE-470

https://github.com/advisories/GHSA-vmwp-vh32-rj75
https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75
https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011 x_refsource_MISC
https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992 x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 x_refsource_MISC