CVE-2026-55566

Received Received - Intake

DOM-Based XSS in Yamcs Web Application

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55566

EUVD

EUVD-2026-67845

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.12.8\|end_excluding=5.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-55566 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Yamcs software. It affects versions up to 5.13.1 and 5.12.7. The flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL targeting the /ext endpoint. The vulnerability exists due to improper neutralization of user input before DOM rendering through innerHTML.

Detection Guidance

To detect this vulnerability, inspect Yamcs web application logs for requests to the /ext endpoint containing unusual or malicious payloads. Check for URLs with script tags or event handlers like onerror. Verify if your Yamcs version is below 5.12.8 or 5.13.2. Use browser developer tools to monitor DOM changes and script execution when accessing the /ext route.

Impact Analysis

An attacker could send a phishing email with a malicious link. When opened, the link executes JavaScript in your browser. This script can read data available to the Yamcs web application and perform actions in your user context, potentially stealing sensitive information or taking unauthorized actions.

Mitigation Strategies

Upgrade Yamcs to version 5.12.8 or 5.13.2 or later immediately. If upgrading is not possible, restrict access to the /ext endpoint via network controls. Implement input validation for extension names using a strict regex pattern. Replace innerHTML with safer DOM manipulation methods like document.createElement.

Hi! I’m here to help you understand CVE-2026-55566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70