CVE-2026-55566 in Yamcs
Summary
by MITRE • 08/28/2026
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the Yamcs mission control framework constitutes a critical Cross-Site Scripting (XSS) flaw rooted in improper input validation and unsafe DOM manipulation practices. Specifically, the defect resides in the handling of data received via the /ext URL route, which is processed by key components including extension.matcher.ts, extension.component.ts, and app.component.ts within the yamcs-web source tree. The core technical failure involves the framework's decision to render attacker-controlled content directly into the Document Object Model using innerHTML without first verifying that the data corresponds to a registered or whitelisted plugin ID. This architectural oversight allows malicious actors to inject arbitrary JavaScript payloads by crafting specific URLs that exploit this lack of validation, effectively bypassing security controls intended to restrict execution contexts to trusted sources only.
From an operational perspective, the impact of this vulnerability is severe due to its potential for remote code execution within the context of a legitimate user's session. When a victim with valid access credentials opens a crafted URL, the embedded script executes automatically in their browser environment. This grants the attacker full control over the web application interface on behalf of the victim, enabling them to read sensitive mission data, configuration details, and telemetry streams that are accessible through the Yamcs web interface. Furthermore, because the scripts run with the same privileges as the authenticated user, an adversary can perform arbitrary actions within the system, such as modifying parameters, initiating commands, or exfiltrating confidential information, thereby compromising the integrity, confidentiality, and availability of the mission control operations managed by Yamcs.
This vulnerability aligns closely with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism of using innerHTML without sanitizing or validating input against a whitelist falls under CWE-83, where the application fails to neutralize special elements before they are used in HTML tags. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based scripting languages like JavaScript. The attack vector is classified as Remote (Network) with High Privileges required for initial access but Low complexity due to the simplicity of crafting a malicious URL that can be delivered via phishing or other social engineering tactics.
To mitigate this risk, organizations running Yamcs must immediately upgrade to version 5.12.8 or later, where these specific versions incorporate fixes that enforce strict validation of plugin IDs before any DOM rendering occurs. For environments unable to patch immediately due to operational constraints, a temporary mitigation involves implementing a Web Application Firewall rule set designed to detect and block suspicious patterns in URL parameters associated with the /ext route, particularly those containing script tags or event handlers. Additionally, developers should review other instances of innerHTML usage within the Yamcs codebase to ensure that all dynamic content generation follows secure coding standards by utilizing textContent for plain text insertion or employing robust sanitization libraries when HTML rendering is strictly necessary, thereby preventing similar injection vectors in future deployments.