An authenticated user with permission to submit StreamSQL queries can insert an unescaped LIKE pattern that is compiled into Java source code by the Janino compiler. If the pattern contains a quote character, it injects Java code that executes in the context of the Yamcs server process, allowing the attacker to run arbitrary code and achieve full control over the server. The flaw is a classic code injection weakness (CWE-94) that directly compromises confidentiality, integrity, and availability of the affected system.

The vulnerability affects the Yamcs mission control framework (vendor yamcs, product yamcs). All releases older than 5.12.8 and older than 5.13.2 are impacted. The attack vector is through API endpoints that accept StreamSQL input, including POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, and certain activity searches,

The CVSS score of 9.9 marks this flaw as critical, and while no EPSS score is currently available, the absence does not diminish the severity because the defect allows arbitrary code execution. The vulnerability is not listed in the CISA KEV catalog, so no confirmed public exploits are known, but the high CVSS and the nature of the flaw warrant rapid action. Because it requires authentication and access to the StreamSQL endpoints, any user with the necessary privileges can exploit it, making the risk high for installations that grant broad write permissions to these endpoints.