CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Summary templateArgs sent to POST /api/instances and PATCH /api/instances/instance are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services:...