Executive brief
Yamcs is a satellite command and telemetry system used for space mission operations. The application contains a cross-site scripting vulnerability in its extension routing system that allows attackers to execute malicious code in users' browsers without authentication. An attacker can craft a phishing link and send it to users; when clicked, it silently executes arbitrary JavaScript, potentially enabling account hijacking, data theft, or further system compromise.
Technical details
This is a DOM-based XSS vulnerability (CWE-79) in the /ext URL endpoint of Yamcs. The root cause is the unsafe use of innerHTML in extension.component.ts (line 40) combined with insufficient input validation in extension.matcher.ts (line 12) and app.component.ts (line 134). An unauthenticated attacker can inject malicious JavaScript by crafting a URL like http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject. The attack requires user interaction (the user must visit the malicious link). No authentication or special privileges are required. Patches are available in versions 5.12.8 and 5.13.2, which implement fixes such as using document.createElement instead of innerHTML, validating extensions against registered plugin IDs, and enforcing strict custom-element-name regex validation.
Affected products
- Yamcs Yamcs 5.13.0-5.13.1, 5.12.7 and earlier
Timeline
- 2026-07-14: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-08-28: advisory: Advisory updated and reviewed on GitHub
- 2026-08-28: patched: Patches released in versions 5.12.8 and 5.13.2