What’s Vulnerable › Vulnerabilities

CVE-2026-44632: Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-16 · updated 2026-07-17
• Weakness: CWE-94

Description

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

Affected products

• yamcs: before 5.12.7 — fixed in 5.12.7

How to fix

Upgrade to a fixed version: yamcs 5.12.7. Check the vendor advisory for mitigations.

References

• https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011
• https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
• https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6
• https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6

Get alerted when CVE-2026-44632 or the next vulnerability affects your stack