CVE-2026-55565

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2

Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An attacker can use a double quote character to break out of the string literal and inject arbitrary Java code, which is then executed by the server process. This allows for remote code execution (RCE) as the OS user running Yamcs.

The issue is reachable through several endpoints, including those requiring only read-only privileges:

The vulnerability exists in the LikeExpression.fillCode getValueReturn() function within LikeExpression.java, where the likeClause.pattern variable is appended raw to the code instead of using ValueExpression.escapeJavaString().

Recommendations Update to version 5.12.8 or 5.13.2. As a temporary mitigation, restrict access to the POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, and activity search endpoints to trusted users only.