---
id: CVE-2026-55559
title: Yamcs is a mission control framework
summary: >-
  Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs
  inserts templateArgs from POST /api/instances and PATCH
  /api/instances/{instance} into YAML through VarStatement.append in
  yamcs-core/src/main/java/org/yamcs/templat…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
  - CWE-470
  - CWE-1336
vendor: yamcs
product: 'org.yamcs:yamcs-core'
affected:
  - 'org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1'
  - 'org.yamcs:yamcs-core <= 5.12.7'
patched:
  - 'org.yamcs:yamcs-core 5.13.2'
  - 'org.yamcs:yamcs-core 5.12.8'
published: '2026-08-28'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:08:37.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55559'
references:
  - url: >-
      https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa
    label: security-advisories@github.com
  - url: >-
      https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8'
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2'
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9'
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-73mf-m39p-wpm9'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00784
epssPercentile: 0.54104
aliases:
  - GHSA-73mf-m39p-wpm9
ecosystem: maven
ingestedAt: '2026-08-28T18:23:38.006Z'
---

## Overview

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55559)

Affected packages:

- `org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1`
- `org.yamcs:yamcs-core <= 5.12.7`

Patched in:

- `org.yamcs:yamcs-core 5.13.2`
- `org.yamcs:yamcs-core 5.12.8`

Source: https://github.com/advisories/GHSA-73mf-m39p-wpm9