Executive brief
Yamcs is a mission control framework used to manage space missions and complex telemetry data. A security vulnerability in its script evaluation engine allows an authorized user to inject malicious code into the system. If exploited, an attacker could take complete control of the server hosting the framework, potentially leading to data theft or disruption of mission operations.
Technical details
A code injection vulnerability exists in the Yamcs script evaluation engine for Python algorithms. Prior to versions 5.12.7 and 5.13.0, the engine used Jython via the JSR-223 ScriptEngine API to compile and evaluate user-controlled algorithm text without a secure sandbox. An authenticated attacker with 'ChangeMissionDatabase' privileges can use the mission database REST API to override algorithm logic. By importing and executing arbitrary Java classes (e.g., java.lang.Runtime), the attacker can achieve remote code execution (RCE) on the underlying host. The fix involves disabling algorithm editing by default.
Affected products
- Yamcs Yamcs < 5.12.7, < 5.13.0
Timeline
- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-07-16: disclosed: CVE-2026-46621 published
References
- https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011
- https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj