CVE-2026-55565

Received Received - Intake

Code Injection in Yamcs Mission Control Framework

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55565

EUVD

EUVD-2026-67844

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.12.8\|end_excluding=5.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in Yamcs allows authenticated users to inject malicious Java code via unescaped LIKE patterns in StreamSQL queries. The issue occurs because user input in LIKE patterns is directly embedded into Java source code generated at runtime without proper escaping. This can lead to remote code execution on the Yamcs server process.

Detection Guidance

Check Yamcs server logs for suspicious executeSql or streamSql API requests containing LIKE patterns with quotes or special characters. Inspect Java source generation logs for unescaped patterns. Verify Yamcs version is 5.12.8 or 5.13.2 or later.

Impact Analysis

An attacker with low-privilege access could execute arbitrary OS commands on the Yamcs server. This may allow them to tamper with telemetry data, access sensitive files, or move laterally within the network. The impact includes full compromise of the Yamcs server and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A successful exploit may result in data breaches, unauthorized modifications, or disclosure of regulated data, leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade Yamcs to version 5.12.8 or 5.13.2 or later immediately. Restrict access to executeSql, streamSql, and readRows endpoints. Monitor for unusual activity in Yamcs logs. Apply principle of least privilege to Yamcs user accounts.

Hi! I’m here to help you understand CVE-2026-55565. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70