CVE-2026-55511

Yamcs, an open-source mission control framework, is vulnerable to code injection (CWE-94) because double-quoted StreamSQL column names are interpolated unescaped into generated Java source, which is then compiled in-process by the Janino compiler. An authenticated user holding the SystemPrivilege.ControlArchiving privilege can trigger the flaw by submitting a crafted query containing a sum aggregate to POST /api/archive/{instance}:executeSql; the injected column name is embedded in generated Java (via SelectExpression.compile and SumExpression) and executed as arbitrary Java code in the Yamcs server process. A successful attacker can read mission data and credentials accessible to that process, tamper with telemetry, or cause a denial of service. Any deployment running Yamcs versions prior to 5.12.8 and 5.13.2, where users with the ControlArchiving privilege can reach the archive SQL API, is affected. No public proof-of-concept or in-the-wild exploitation is currently known; EPSS estimates a 0.7% probability of exploitation within 30 days.

What to do: Upgrade to Yamcs 5.12.8 or 5.13.2 (or later). Until patched, restrict the SystemPrivilege.ControlArchiving privilege to trusted accounts only and limit network access to the POST /api/archive/{instance}:executeSql endpoint. Review logs for unexpected aggregate SQL queries using double-quoted column names, which could indicate exploitation attempts.