CVE-2026-55559

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2

Description Yamcs fails to properly escape templateArgs when inserting them into YAML configurations via the VarStatement.append function in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java. This occurs when using the 'POST /api/instances' and 'PATCH /api/instances/{instance}' endpoints. An attacker can inject a services entry for org.yamcs.ProcessRunner, allowing the execution of arbitrary commands as the Yamcs service account on the host system.

In deployments where security.yaml is absent, the guest superuser can perform this action without authentication. In secured deployments, the SystemPrivilege.CreateInstances privilege is required. The issue persists because the EscapeFilter only performs HTML escaping and does not handle newlines, colons, or indentation required for YAML context.

Recommendations Update Yamcs to version 5.12.8 or later. Update Yamcs to version 5.13.2 or later.