Yamcs processes data from the /ext URL route without validating plugin IDs before rendering it into the page via innerHTML. This oversight allows an attacker to embed arbitrary JavaScript that executes in the browser of any user who navigates to a crafted URL. The injected script can read the application data available to the authenticated session and perform actions on the user’s behalf. The flaw is a typical DOM-based XSS (CWE‑79) and can lead to data exposure or manipulation within the user context.

All versions of Yamcs prior to 5.12.8 and 5.13.2 are affected. This includes any installation of the Yamcs framework that relies on the /ext route for extension routing. The issue is present in the JavaScript files extension.matcher.ts, extension.component.ts, and app.component.ts found in the webapp source.

The CVSS score is 4.3, indicating a moderate severity. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to open a maliciously crafted URL that targets the /ext route. The attack is client‑side; no server compromise is needed, but a compromised or untrusted browser session can be leveraged to read or modify data. The risk is elevated for environments where users routinely click unknown links or when the /ext route is exposed to untrusted networks.