CVE-2026-55511

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2

Description Yamcs compiles StreamSQL expressions into Java source code using the Janino SimpleCompiler without a restrictive sandbox. An authenticated user with SystemPrivilege.ControlArchiving can create a column with a double-quoted name containing arbitrary Java code. When a sum aggregate is performed on this column via the POST /api/archive/{instance}:executeSql endpoint, the malicious column name is interpolated unescaped into the generated Java source through the Expression.fillCode InputDefVars and Expression.sanitizeName functions. This allows the injected code to be compiled and executed within the Yamcs server JVM with the privileges of the server process. This can lead to remote code execution, exposing mission data and credentials, permitting telemetry tampering, or causing a denial of service.

Recommendations Update Yamcs to version 5.12.8 or 5.13.2. As a temporary mitigation, restrict the SystemPrivilege.ControlArchiving privilege to only trusted users to prevent the creation of malicious columns and the execution of arbitrary SQL statements.