CVE-2026-46562

Name of the Vulnerable Software and Affected Versions Yamcs versions 4.7.3 through 5.12.6

Description The Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java is constructed without a ClassFilter. This allows a user with the ChangeMissionDatabase privilege to execute arbitrary Java code on the server by supplying malicious JavaScript that reaches arbitrary Java classes, such as java.lang.Runtime, to execute OS commands as the Yamcs process. In the default configuration where no security.yaml is present, the built-in guest user has superuser=true, enabling unauthenticated remote code execution. The issue is triggered via the MdbOverrideApi.updateAlgorithm endpoint.

Recommendations Update to version 5.12.7 or 5.13.0. Restrict access to the MdbOverrideApi.updateAlgorithm endpoint to minimize the risk of exploitation.