CVE-2026-46621 in Yamcs
Summary
by MITRE • 07/16/2026
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/16/2026
The vulnerability in Yamcs prior to version 5.12.7 represents a critical security flaw that stems from insufficient sandboxing mechanisms within the script evaluation engine. This issue specifically affects the Python algorithm execution environment where user-controlled code is dynamically compiled and evaluated through Jython's JSR-223 ScriptEngine API. The absence of proper security boundaries allows authenticated users with minimal privileges to exploit this weakness, fundamentally undermining the system's integrity and security posture.
The technical implementation of this vulnerability exploits a design flaw in how Yamcs handles algorithm modifications through its mission database REST API. When an authenticated user possessing the ChangeMissionDatabase privilege attempts to modify Python algorithms, the system fails to enforce proper code validation or sandboxing measures. This oversight permits attackers to inject malicious code that bypasses normal execution constraints, effectively enabling arbitrary code execution capabilities on the underlying host operating system. The vulnerability specifically leverages the ability to import and execute Java classes such as java.lang.Runtime, which provides direct access to system-level operations.
The operational impact of this vulnerability extends far beyond simple privilege escalation, as it creates a complete bypass of the system's security model. An attacker with minimal privileges can leverage this weakness to execute arbitrary commands on the host system, potentially leading to full system compromise. This scenario presents a significant risk in mission-critical environments where Yamcs is deployed, as unauthorized code execution could disrupt operations, compromise sensitive data, or provide attackers with persistent access to the infrastructure. The vulnerability effectively transforms what should be a controlled environment into a potential attack surface for remote code execution.
The fix implemented in versions 5.12.7 and 5.13.0 addresses this vulnerability by disabling algorithm editing functionality by default, thereby preventing unauthorized modifications to Python algorithms. This approach follows the principle of least privilege and reduces the attack surface by eliminating the capability for users to modify core system components through the REST API. The solution aligns with security best practices outlined in CWE-74 and CWE-94, which address code injection vulnerabilities and insecure direct object references respectively. Organizations implementing Yamcs should ensure immediate upgrade to these patched versions to mitigate the risk of exploitation.
From an ATT&CK framework perspective, this vulnerability maps to multiple techniques including T1059.006 for Python command execution and T1068 for local privilege escalation. The attack chain begins with initial access through legitimate user credentials followed by exploitation of the script engine vulnerability to achieve code execution. This represents a classic case of privilege abuse where legitimate system functionality is misused to circumvent security controls, highlighting the importance of proper input validation and sandboxing mechanisms in enterprise systems.
The remediation approach taken by Yamcs developers demonstrates effective vulnerability management practices, as disabling algorithm editing by default prevents exploitation while maintaining system functionality for authorized users. This solution requires administrators to explicitly enable the feature when necessary, ensuring that any potential security risks are consciously accepted rather than inadvertently introduced through default configurations. The fix also emphasizes the importance of secure coding practices in interpreted environments where dynamic code execution capabilities must be carefully controlled and constrained.