GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

EUVD-2026-67836

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

SUSE CVE-2011-2930

Multiple SQL injection vulnerabilities in the quotetablename method in the ActiveRecord adapters in activerecord/lib/activerecord/connectionadapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a...