Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Yamcs can run malicious code via crafted search patterns

CVE-2026-55565 · published 6 days ago
Summary

Older versions of the Yamcs mission control software could insert user‑provided search strings into Java code without proper escaping. An attacker could include a quote in the pattern to inject and run arbitrary code on the server, potentially compromising the system. Upgrade to Yamcs version 5.12.8 or later (or 5.13.2 for that branch) to apply the fix.

Original advisory text
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an u...
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (NVD)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published28 Aug 2026
Updated3 Sep 2026
First seen29 Aug 2026
Sources
CVE-2026-55565 · NVD
GHSA-c64q-hj4j-375f · GHSA
CVE-2026-55565 · OSV
Monitor software like this
Free during beta