{"items":[{"id":"NVI-00013987","kind":"vulnerability","title":"Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-73mf-m39p-wpm9","CVE-2026-55559"],"plain_summary":"GitHub lists this reviewed advisory for org.yamcs:yamcs-core, org.yamcs:yamcs-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2d5c40250e3438556364e38198ae8610"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-28T17:23:05.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2d5c40250e3438556364e38198ae8610"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2d5c40250e3438556364e38198ae8610","url":"https://github.com/advisories/GHSA-73mf-m39p-wpm9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-73mf-m39p-wpm9","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:23.004Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2d5c40250e3438556364e38198ae8610"],"technology":"org.yamcs:yamcs-core","known_exclusions":[],"conditions_summary":"### Summary\n\n`templateArgs` sent to `POST /api/instances` (and `PATCH /api/instances/{instance}`) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each `services:` entry by its `class:`, so injecting YAML through a template arg lets you add a `services:` entry for `org.yamcs.ProcessRunner` and run a command on the host. The args aren't escaped for YAML or validated server-side.\n\nNeeds the `CreateInstances` privilege. With no `security.yaml` the `guest` user is `superuser=true` and the API is unauthenticated, so it's reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn't touch this path.\n\n### Details\n\n`VarStatement` appends arg values with no escaping:\n\n```java\n// yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java:29\nbuf.append(value);\n```\n\nThe only filter, `EscapeFilter`, does HTML escaping (`&  ' \"`) and leaves newlines, colons and indentation alone, so `{{ x | escape }}` doesn't help either. `InstancesApi.createInstance` forwards the args without checking them against the declared variables; the `choices` / `required` metadata is only used to render the web","public_affected_ranges":[">= 5.13.0, <= 5.13.1"]},{"certainty":"source_listed","source_ids":["sr-2d5c40250e3438556364e38198ae8610"],"technology":"org.yamcs:yamcs-core","known_exclusions":[],"conditions_summary":"### Summary\n\n`templateArgs` sent to `POST /api/instances` (and `PATCH /api/instances/{instance}`) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each `services:` entry by its `class:`, so injecting YAML through a template arg lets you add a `services:` entry for `org.yamcs.ProcessRunner` and run a command on the host. The args aren't escaped for YAML or validated server-side.\n\nNeeds the `CreateInstances` privilege. With no `security.yaml` the `guest` user is `superuser=true` and the API is unauthenticated, so it's reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn't touch this path.\n\n### Details\n\n`VarStatement` appends arg values with no escaping:\n\n```java\n// yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java:29\nbuf.append(value);\n```\n\nThe only filter, `EscapeFilter`, does HTML escaping (`&  ' \"`) and leaves newlines, colons and indentation alone, so `{{ x | escape }}` doesn't help either. `InstancesApi.createInstance` forwards the args without checking them against the declared variables; the `choices` / `required` metadata is only used to render the web","public_affected_ranges":["<= 5.12.7"]}],"null_published_at":"2026-11-02T10:00:37.194Z","source_updated_at":"2026-08-28T17:23:05.000Z","source_disclosed_at":"2026-08-28T17:23:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:23.004Z"}],"next_cursor":null,"snapshot_revision":"42594"}