CVE-2026-55565
Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Critical9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | Critical9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.65% · top 49% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.yamcs:yamcs-coreGHSA-c64q-hj4j-375f (opens in a new tab)
References (5)
- https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663 (opens in a new tab)x_refsource_MISC
- https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c (opens in a new tab)x_refsource_MISC
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 (opens in a new tab)x_refsource_MISC
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-c64q-hj4j-375f (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-55565)Record last updated .