Yamcs, a mission control framework, permits an authenticated user with the SystemPrivilege.ControlArchiving privilege to craft a double‑quoted StreamSQL column name that is directly interpolated into generated Java source code. The injection path originates in Expression.fillCode_InputDefVars and Expression.sanitizeName, ultimately reaching CompilableAggregateExpression and SumExpression during SELECT compilation. When the POST /api/archive/{instance}:executeSql endpoint is called, Janino compiles the injected source, allowing arbitrary Java to run inside the Yamcs server process. This flaw exposes mission data, credentials, permits telemetry tampering, and enables denial‑of‑service attacks. The weakness is classified as CWE‑94, an injection of source code. The vulnerability is exploitable only by users who can authenticate to Yamcs and hold the ControlArchiving permission. An attacker who gains or is granted this privilege can send crafted SQL expressions directly from the API, leading to full code execution on the server hosting Yamcs. The impact extends system stability and confidentiality, potentially compromising all mission data. A CVSS score of 9.1 indicates a high severity, while the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires privileged access, an internal attacker or a compromised privileged account can exploit it without needing network exposure beyond the internal Yamcs environment. The lack of publicly available exploit code does not reduce the technical risk, as the code paths are clear and an experienced attacker could craft a payload quickly. The presence of the patch in newer releases mitigates the risk only if the system is upgraded.

The affected product is Yamcs (org.trans4m yamcs:yamcs). Versions prior to 5.12.8 and 5.13.2 are vulnerable. Specifically, any release from earliest 5.12.0 up to 5.12.7 and from 5.13.0 up to 5.13.1 contains the flaw; the issue is fixed in 5.12.8 and 5.13.2 and later versions are presumed secure.

The CVSS score of 9.1 reflects a critical attack surface: an attacker can achieve full system compromise, disrupt mission operations, and manipulate telemetry. Since the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the absence of public exploits does not mitigate risk because the code paths are plainly documented. The vulnerability requires an authenticated user with the SystemPrivilege.ControlArchiving privilege; therefore, the attack vector is internal, leveraging legitimate access. If an attacker gains privileged credentials or compromises an account with that privilege, they can send a crafted SQL expression via the REST API, leading to arbitrary Java execution in the Yamcs server process. Because the flaw is specific to a privileged API operation, the exposure to external actors is limited to those who can obtain or are granted the necessary privilege. However, within an organization, compromise of such accounts can occur through social engineering or credential theft, providing a realistic threat vector. The presence of the patch in newer releases reduces risk only upon upgrade; otherwise, the vulnerability remains a critical threat.