CVE-2026-44632

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011	Patch
https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992	Patch
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7	Release Notes
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0	Release Notes
https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6	Exploit Vendor Advisory
https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-16 17:16

Updated : 2026-07-17 18:38

NVD link : CVE-2026-44632

Mitre link : CVE-2026-44632

CVE.ORG link : CVE-2026-44632

JSON object : View

Products Affected

spaceapplications

yamcs

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-44632", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44632", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T16:45:59.615647Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "yamcs", "product": "yamcs", "versions": [{"status": "affected", "version": "< 5.12.7"}]}]}], "published": "2026-07-16T17:16:56.023", "references": [{"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."}], "lastModified": "2026-07-17T18:38:47.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F836127-88FB-4BD4-AD07-FE5B324349CD", "versionEndExcluding": "5.12.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}