Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T20:18:27.947Z",
  "pubdate": "2026-08-28T20:18:27.947Z",
  "executiveSummary": "Yamcs is affected by a critical vulnerability involving improper input sanitization within its StreamSQL processing engine, leading to Remote Code Execution (RCE).\nThe vulnerability originates from the insecure interpolation of user-defined StreamSQL column names into generated Java source code.\nAn authenticated attacker possessing the SystemPrivilege.ControlArchiving privilege can leverage the /api/archive/{instance}:executeSql endpoint to inject malicious Java payloads.\nThese payloads are subsequently compiled and executed by the Janino SimpleCompiler within the Yamcs server process.\nSuccessful exploitation grants the attacker the ability to execute arbitrary code with the same privileges as the Yamcs process, leading to a total compromise of mission data, leakage of system credentials, unauthorized telemetry manipulation, and potential denial of service.\nThis vulnerability affects Yamcs versions prior to 5.12.8 and 5.13.2.\nGiven the severity and the nature of the mission control framework, this risk is considered critical, requiring immediate remediation through version updates.",
  "technicalDetails": "The vulnerability exists within the StreamSQL compilation pipeline, specifically involving how column identifiers are handled during the transformation of SQL queries into executable Java bytecode.\nThe root cause is identified in the Expression.fillCode_InputDefVars and Expression.sanitizeName functions, which fail to adequately sanitize double-quoted column names. When a user provides a specially crafted column name, it is improperly interpolated directly into the Java source code generated for the query.\nThe attack flow initiates when a request is sent to the POST /api/archive/{instance}:executeSql endpoint. By embedding a malicious payload within a StreamSQL column alias or name, the attacker forces the application to treat the input as part of the operational code structure.\nThis injected source code flows through the compilation chain, reaching SelectExpression.compile, and subsequently triggering logic within CompilableAggregateExpression.java and SumExpression.java.\nThe ultimate execution point is the Janino SimpleCompiler.cook function, which compiles the dynamically generated, tainted Java code into classes that execute in the context of the running Yamcs JVM.\nBecause the Janino compiler processes the interpolated input as legitimate code instructions, the attacker can break out of the intended data processing logic to perform arbitrary system operations.\nThis exploitation requires the attacker to have already obtained the SystemPrivilege.ControlArchiving privilege, suggesting a focus on privilege escalation from an already authorized user or an insider threat vector.\nOnce the malicious Java code is executed, the impact is severe. The attacker can perform read/write operations on mission-critical telemetry, exfiltrate sensitive environment credentials stored in the server memory or configuration, or induce a crash to achieve denial of service (DoS).\nBecause the payload runs with the privileges of the service, the attacker effectively gains full administrative control over the Yamcs server instance, bypassing all higher-level application logic and security controls."
}