https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T23:27:48.693135+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-55565 fkie_cve-2026-55565 2026-10-01T23:27:48.728000+00:00

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.

 https://vulnerability.circl.lu/vuln/ghsa-c64q-hj4j-375f GHSA-c64q-hj4j-375f — Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`Lik… 2026-10-01T23:27:48.728129+00:00

Affected: Maven: org.yamcs:yamcs-core

## Summary Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The `LIKE` operator inserts the user-supplied pattern into the generated Java **unescaped**, inside a `"..."` literal, so a pattern containing `"` breaks out and injects arbitrary Java (e.g. a `static{}` block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.

The pattern is embedded raw whether it comes from a SQL string literal or a bound `?` argument, so the sink is reachable from any endpoint that builds a `LIKE` from user input, at routine **read-only** privileges, not just `executeSql`: - `POST /api/archive/{instance}:executeSql` and `:streamSql` (privilege `ControlArchiving`) - `POST /api/archive/{instance}/tables/{table}:readRows` via the `query` field (privilege `ReadTables`) - `GET /api/archive/{instance}/events?q=` and the event export/stream variants (privilege `ReadEvents`) - `listActivities` `q` (privilege `ReadActivities`)

The Events page search box feeds `q` directly.

Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of `ChangeMissionDatabase` and is not affected by the `overrideAlgorithmsEnabled` gate.

## Details - **Sink:** `Expression#getCompiledExpression` compiles generated source with `SimpleCompiler.cook(...)` (`Expression.java:205`) and instantiates it (`Expression.java:213`) at stream prep, before any tuple flows. - **Injection:** `LikeExpression#fillCode_getValue…