Executive brief
Yamcs is a mission control framework used for space missions and complex telemetry systems. A vulnerability in its algorithm engine allows an authorized user to inject and execute malicious code on the server hosting the software. This could lead to a complete takeover of the mission control server, potentially disrupting operations or exposing sensitive mission data.
Technical details
A server-side code injection vulnerability exists in the Yamcs algorithm evaluation engine, specifically within the 'org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory' component. The engine uses the Janino compiler to dynamically compile and evaluate user-provided algorithm text without a secure sandbox. An authenticated attacker with 'ChangeMissionDatabase' privileges can use the mission database REST API to override algorithm text with malicious Java code (e.g., using java.lang.Runtime). This results in remote code execution (RCE) on the host operating system. The vulnerability is addressed in versions 5.12.7 and 5.13.0 by disabling algorithm editing by default.
Affected products
- Yamcs Yamcs < 5.12.7, < 5.13.0
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
- 2026-05-21: patched
References
- https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011
- https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6