Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the LikeExpression process. An attacker can execute arbitrary operating system commands by supplying a crafted pattern containing unescaped characters that are injected into dynamically generated Java code a...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...