Yamcs allows a remote actor to inject arbitrary YAML content via the templateArgs field in POST /api/instances and PATCH /api/instances/{instance}. The injected YAML can add a services entry that references org.yamcs.ProcessRunner, causing the server to execute commands under the Yamcs service account. This flaw arises from improper input validation (CWE‑1336), lack of context escaping (CWE‑470), and full command injection capabilities (CWE‑94). Successful exploitation grants the attacker the ability to run arbitrary system commands with the privileges of the Yamcs service account, fully compromising the host.

The vulnerability affects installations of the Yamcs mission control framework before version 5.12.8 or 5.13.2. Any deployment, especially those lacking a security.yaml file, is exposed because the API endpoints permit injection via POST or PATCH to `/api/instances`. Secure deployments require the SystemPrivilege.CreateInstances role; however, once that privilege is granted the flaw remains exploitable.

The CVSS score of 9.8 classifies this flaw as Critical. Exploitation does not require privileged authentication beyond the normal API calling rights and can be performed directly over the network via crafted requests. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and broad exposure of API endpoints indicate a high probability of exploitation. Attackers with access to the API can achieve full remote code execution as the Yamcs service account, making this a top priority for remediation.