Yamcs, a mission control framework, contains a server‑side code injection flaw (CWE‑94) in its JavaExprAlgorithmExecutionFactory module. When an authenticated user with the ChangeMissionDatabase privilege submits algorithm text through the mission database REST API, the text is compiled by the Janino compiler without enforcing a secure sandbox. This allows the user to override existing algorithm definitions with arbitrary Java code, such as invoking java.lang.Runtime, giving the attacker remote code execution capability on the host operating system. Consequently, the attacker can execute shell commands, read or modify system files, or pivot to other services, compromising confidentiality, integrity, and availability of the mission control system.

The affected product is Yamcs from the yamcs:yamcs vendor. Versions prior to 5.12.7 are vulnerable; the fix is delivered in releases 5.12.7 and 5.13.0 through disabling algorithm editing by default.

The CVSS score is 9.1, indicating a high severity vulnerability. The EPSS score indicates a very low but nonzero exploitation probability (1%) and the flaw is not listed in the CISA KEV catalog, meaning publicly known exploitation data is limited. The attack requires an authenticated user with the ChangeMissionDatabase privilege, as that privilege allows overwriting algorithm definitions via the mission database REST API. Therefore, the attack vector is via a privileged REST API call, and the exploitation needs both authentication and authorization, making it dependent on user trust boundaries rather than open network exposure.