https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:27:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55565 <p>Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.</p> <p>Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55565 https://vulnerability.circl.lu/vuln/ghsa-c64q-hj4j-375f <p><strong>Affected:</strong> Maven: org.yamcs:yamcs-core</p> <p>## Summary Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The `LIKE` operator inserts the user-supplied pattern into the generated Java **unescaped**, inside a `&#34;...&#34;` literal, so a pattern containing `&#34;` breaks out and injects arbitrary Java (e.g. a `static{}` block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.</p> <p>The pattern is embedded raw whether it comes from a SQL string literal or a bound `?` argument, so the sink is reachable from any endpoint that builds a `LIKE` from user input, at routine **read-only** privileges, not just `executeSql`: - `POST /api/archive/{instance}:executeSql` and `:streamSql` (privilege `ControlArchiving`) - `POST /api/archive/{instance}/tables/{table}:readRows` via the `query` field (privilege `ReadTables`) - `GET /api/archive/{instance}/events?q=` and the event export/stream variants (privilege `ReadEvents`) - `listActivities` `q` (privilege `ReadActivities`)</p> <p>The Events page search box feeds `q` directly.</p> <p>Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of `ChangeMissionDatabase` and is not affected by the `overrideAlgorithmsEnabled` gate.</p> <p>## Details - **Sink:** `Expression#getCompiledExpression` compiles generated source with `SimpleCompiler.cook(...)` (`Expression.java:205`) and instantiates it (`Expression.java:213`) at stream prep, before any tuple flows. - **Injection:** `LikeExpression#fillCode_getValue…</p> <p><strong>Affected:</strong> Maven: org.yamcs:yamcs-core</p> <p>## Summary Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The `LIKE` operator inserts the user-supplied pattern into the generated Java **unescaped**, inside a `&#34;...&#34;` literal, so a pattern containing `&#34;` breaks out and injects arbitrary Java (e.g. a `static{}` block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.</p> <p>The pattern is embedded raw whether it comes from a SQL string literal or a bound `?` argument, so the sink is reachable from any endpoint that builds a `LIKE` from user input, at routine **read-only** privileges, not just `executeSql`: - `POST /api/archive/{instance}:executeSql` and `:streamSql` (privilege `ControlArchiving`) - `POST /api/archive/{instance}/tables/{table}:readRows` via the `query` field (privilege `ReadTables`) - `GET /api/archive/{instance}/events?q=` and the event export/stream variants (privilege `ReadEvents`) - `listActivities` `q` (privilege `ReadActivities`)</p> <p>The Events page search box feeds `q` directly.</p> <p>Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of `ChangeMissionDatabase` and is not affected by the `overrideAlgorithmsEnabled` gate.</p> <p>## Details - **Sink:** `Expression#getCompiledExpression` compiles generated source with `SimpleCompiler.cook(...)` (`Expression.java:205`) and instantiates it (`Expression.java:213`) at stream prep, before any tuple flows. - **Injection:** `LikeExpression#fillCode_getValue…</p> https://vulnerability.circl.lu/vuln/ghsa-c64q-hj4j-375f