CVE-2026-44632

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.7

Description A server-side code injection issue exists in the algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory. The system dynamically compiles and evaluates user-controlled algorithm text using the Janino compiler without a secure sandbox. An authenticated user with the ChangeMissionDatabase privilege can exploit this by overriding an existing algorithm's text via the mission database REST API to inject Java code, such as java.lang.Runtime, leading to remote code execution on the host operating system.

Recommendations Update to version 5.12.7 or 5.13.0. Restrict access to the mission database REST API for users with the ChangeMissionDatabase privilege to minimize the risk of exploitation.