Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

A code injection vulnerability exists in Yamcs, an open-source mission control framework, affecting versions prior to 5.12.8 and 5.13.2. A user with SystemPrivilege.ControlArchiving can craft a malicious double-quoted StreamSQL column name that gets interpolated into dynamically generated Java source code. The injected code travels through Expression.fillCode_InputDefVars, Expression.sanitizeName, and SumExpression, ultimately being compiled and executed by the Janino SimpleCompiler. Exploitation is triggered via the POST /api/archive/{instance}:executeSql API endpoint. Successful exploitation allows arbitrary Java code execution within the Yamcs server process. Potential impacts include exposure of sensitive mission data and credentials, telemetry tampering, and denial of service. The vulnerability has been patched in Yamcs versions 5.12.8 and 5.13.2.