Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

Critical 9.8

In plain English

A critical-severity code injection in yamcs from yamcs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.yamcs:yamcs-core5.13.2GHSA-73mf-m39p-wpm9
Mavenorg.yamcs:yamcs-core5.12.8GHSA-73mf-m39p-wpm9

Affected products (as reported)

VendorProductVersions
yamcs yamcs < 5.12.8>= 5.13.0, < 5.13.2

Weakness: CWE-94, CWE-470, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References