Yamcs is a mission control framework. The vulnerability originates from the Nashorn ScriptEngine that Yamcs uses to evaluate user‑supplied JavaScript algorithms. Prior to version 5.12.7, the Nashorn ScriptEngine used to evaluate user‑supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process. In the default configuration with no security.yaml the built‑in guest user has superuser=true, making the issue reachable without authentication. The issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

The affected product is Yamcs by yamcs:yamcs, versions prior to 5.12.7 and 5.13.0. The issue was introduced before the 5.12.7 release and was mitigated in that release as well as in 5.13.0 through disabling algorithm editing by default and tightening script evaluation. Any deployment of the default configuration that allows a guest user with superuser rights to edit mission database algorithms is vulnerable.

The CVSS score is 9.8, indicating critical severity. The EPSS score of <1% indicates a very low but nonzero probability of exploitation in the wild, yet the high impact and lack of authentication requirements make it highly attractive to adversaries. The vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication combined with remote code execution capability presents a severe risk. Exploitation requires a user with ChangeMissionDatabase rights, which can be present in many mission control environments; an attacker could bypass authentication if the protected guest user is enabled, which is the default state.