CVE-2026-46562

Katalog CVE

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada spaceapplications yamcs. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75 exploit · advisory vendor
• https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011 patch
• https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992 patch
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 release notes
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 release notes