Most recent entries from all

EUVD-2026-361449

2026-10-06T12:29:07.823707+00:00

EUVD-2026-361449

fkie_cve-2026-55559

2026-10-06T12:29:07.823752+00:00

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

GHSA-73mf-m39p-wpm9 — Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

2026-10-06T12:29:07.823791+00:00

Affected: Maven: org.yamcs:yamcs-core

### Summary

`templateArgs` sent to `POST /api/instances` (and `PATCH /api/instances/{instance}`) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each `services:` entry by its `class:`, so injecting YAML through a template arg lets you add a `services:` entry for `org.yamcs.ProcessRunner` and run a command on the host. The args aren't escaped for YAML or validated server-side.

Needs the `CreateInstances` privilege. With no `security.yaml` the `guest` user is `superuser=true` and the API is unauthenticated, so it's reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn't touch this path.

### Details

`VarStatement` appends arg values with no escaping:

```java // yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java:29 buf.append(value); ```

The only filter, `EscapeFilter`, does HTML escaping (`& < > ' "`) and leaves newlines, colons and indentation alone, so `{{ x | escape }}` doesn't help either. `InstancesApi.createInstance` forwards the args without checking them against the declared variables; the `choices` / `required` metadata is only used to render the web form.

Request to exec: `InstancesApi.createInstance` (`http/api/InstancesApi.java:169`, checks `CreateInstances`) → `YamcsServer.createInstance` (`YamcsServer.java:651`, `template.process(templateArgs)`) → rendered config loaded as `YConfiguration` → `YamcsServerInstance` instantiates `services:`…