Technical impact
Yamcs exposes a code injection flaw (CWE‑94) by using Jython to dynamically compile and execute user‑controlled Python algorithm scripts via the JSR‑223 ScriptEngine API without a secure sandbox. Prior to version 5.12.7, an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm by submitting malicious Python code through the mission database REST API, import arbitrary Java classes such as java.lang.Runtime, and execute commands on the underlying host operating system, thereby achieving remote code execution. The issue is fixed in releases 5.12.7 and 5.13.0, which disable algorithm editing by default.
Affected Systems
The vulnerability affects all installations of Yamcs using the yamcs:yamcs product that are running any release older than 5.12.7, including the 5.12.x series. The fix is delivered in releases 5.12.7 and 5.13.0, where algorithm editing is disabled by default and the insecure script evaluation path is removed.
Risk and Exploitability
With a CVSS score of 9.1, the flaw is classified as critical. It requires valid credentials and the ChangeMissionDatabase privilege, but provides unrestricted code execution once exploit is achieved. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the REST API to authorize a malicious algorithm that loads Java classes and spawns system‑level processes, effectively compromising the host machine.
Github GHSA