Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T20:18:29.207Z",
  "pubdate": "2026-08-28T20:18:29.207Z",
  "executiveSummary": "Yamcs is affected by a Cross-Site Scripting (XSS) vulnerability due to improper input validation within its web application component. The vulnerability resides in the processing logic for the /ext URL route, which fails to sanitize or validate plugin IDs before rendering them directly into the Document Object Model (DOM) using innerHTML. An unauthenticated or authenticated attacker can leverage this flaw by crafting a malicious URL that embeds arbitrary JavaScript.\nWhen a legitimate user navigates to the crafted URL, the malicious script executes within the context of their active session. This allows for the exfiltration of sensitive session data, unauthorized actions performed on behalf of the user, and potential compromise of the Yamcs mission control interface. The vulnerability impacts versions of Yamcs prior to 5.12.8 and 5.13.2. Organizations are at significant risk if users interact with external links containing malicious payloads, as the execution of arbitrary code occurs with the permissions and access level of the authenticated victim. Immediate patching to the identified secure versions is recommended to mitigate the risk of session hijacking and unauthorized data access.",
  "technicalDetails": "The vulnerability is identified as an improper neutralization of input during web page generation, specifically manifesting as a Cross-Site Scripting (XSS) flaw. The root cause lies in the unsafe handling of data derived from the /ext URL route, which is processed by the frontend components: yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts.\nIn the vulnerable versions, the application logic retrieves plugin identifiers directly from the URL parameters and subsequently injects these values into the DOM via innerHTML without performing sufficient validation or sanitization against a registry of authorized plugin IDs. Because innerHTML treats input as HTML markup rather than plain text, any script tags or event handlers embedded within the attacker-controlled input will be parsed and executed by the victim's browser.\nThe attack flow begins when an attacker crafts a URL targeting the /ext endpoint, appending a malicious payload within the parameters meant to represent a plugin ID. Upon clicking this link, the victim's browser directs them to the Yamcs web interface. The frontend application components then extract this malicious string and perform an insecure DOM update. The browser environment interprets the injected script, triggering execution in the security context of the origin where Yamcs is hosted.\nThe scope of impact is significant because the injected script operates under the user's session credentials. Consequently, the script gains the ability to read sensitive data available to the web application, such as session cookies, user profile details, or mission-specific parameters displayed in the UI. Furthermore, the script can perform state-changing operations by making asynchronous requests to the Yamcs backend APIs, effectively allowing the attacker to interact with the mission control system as the victim.\nThis vulnerability is present in all Yamcs versions prior to 5.12.8 and 5.13.2. Exploitation does not require prior authentication if the target is an exposed instance, although the ultimate impact depends on the victim's existing session privileges. No complex infrastructure is required to deliver the payload, as it relies on standard web-based delivery vectors such as email links or forum posts."
}