Executive brief
Yamcs is a mission control framework used for monitoring and controlling remote systems, such as satellites or spacecraft. A security flaw allows an attacker to execute arbitrary commands on the server hosting the framework. This could lead to a total system takeover, unauthorized access to mission data, and disruption of critical operations.
Technical details
A remote code execution (RCE) vulnerability exists in Yamcs due to the insecure configuration of the Nashorn ScriptEngine in ScriptAlgorithmExecutorFactory.java. The engine was constructed without a ClassFilter, allowing JavaScript to access arbitrary Java classes such as java.lang.Runtime. An attacker with ChangeMissionDatabase privileges can exploit this via the MdbOverrideApi.updateAlgorithm endpoint. In default configurations lacking a security.yaml file, the guest user is granted superuser privileges, making the vulnerability exploitable without authentication. The issue is addressed in versions 5.12.7 and 5.13.0 by disabling algorithm editing by default.
Affected products
- Yamcs Yamcs < 5.12.7, < 5.13.0
Timeline
- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-07-16: disclosed: CVE published to NVD
References
- https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011
- https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75