Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T20:18:28.930Z",
  "pubdate": "2026-08-28T20:18:28.930Z",
  "executiveSummary": "Yamcs is susceptible to a critical YAML injection vulnerability occurring within its API-driven instance management framework. The flaw resides in the improper handling of user-supplied template arguments when modifying instance configurations via POST and PATCH requests. By injecting malicious YAML structures into these fields, an attacker can manipulate the internal configuration rendering process.\nThe vulnerability allows for the unauthorized registration of services, specifically leveraging org.yamcs.ProcessRunner to execute arbitrary system commands under the security context of the Yamcs service account. The impact is a total compromise of the host system. Affected deployments include versions prior to 5.12.8 and 5.13.2.\nExploitation prerequisites vary based on the deployment's security posture; deployments lacking a configured security.yaml may permit unauthenticated guest superuser access, while secured environments require the SystemPrivilege.CreateInstances privilege. Given the severity of arbitrary command execution, this vulnerability represents a high risk to the confidentiality, integrity, and availability of mission control infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is the lack of context-aware escaping when processing user-provided input within the templating engine. Specifically, the application uses VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java to process templateArgs submitted via POST /api/instances or PATCH /api/instances/{instance} API endpoints.\nThe application takes these templateArgs and directly inserts them into a YAML-formatted configuration string without validating or sanitizing the input to prevent control character injection. Once the malformed YAML is generated, it is processed by YamcsServer.createInstance and subsequently loaded by the YamcsServerInstance component. This chain allows an attacker to break out of the intended data structure and inject arbitrary YAML keys and values.\nAn attacker can exploit this by injecting a services entry that points to org.yamcs.ProcessRunner. Because Yamcs interprets this configuration as a valid system definition, it initializes the ProcessRunner service upon instance creation or update. The ProcessRunner component is designed to execute system-level commands, effectively providing a primitive for Remote Code Execution (RCE).\nThe attack flow follows these steps: 1) The attacker constructs a JSON or multipart payload for the API endpoint, embedding malicious YAML syntax within the templateArgs object. 2) The backend application performs an unsanitized string concatenation of this payload into a configuration file. 3) The Yamcs server parses the resulting configuration file, triggering the instantiation of the malicious service defined by the attacker. 4) The Yamcs service account executes the defined command. In environments where security.yaml is absent, this can be triggered by any guest user with access to the API. In secured deployments, the attacker must have obtained the SystemPrivilege.CreateInstances permission, which is often a target for lateral movement within the system."
}