CVE-2026-55566

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2

Description Yamcs is vulnerable to cross-site scripting (XSS), a flaw where an attacker injects malicious scripts into a trusted website. The application processes attacker-controlled data from the '/ext' endpoint without verifying registered plugin IDs before rendering the content through innerHTML. A user opening a crafted URL can trigger the execution of arbitrary JavaScript in their browser, allowing the script to read data accessible to the web application and perform actions within the user context.

Recommendations Update to version 5.12.8. Update to version 5.13.2. Use document.createElement instead of innerHTML in extension.component.ts. Validate the extension against registered plugin IDs. Enforce a strict custom-element-name regex before mounting.