Yamcs up to 5.12.6 Script Evaluation Engine sandbox

Summaryinfo

A vulnerability was found in Yamcs up to 5.12.6. It has been classified as very critical. This issue affects some unknown processing of the component Script Evaluation Engine. The manipulation leads to sandbox. This vulnerability is traded as CVE-2026-46621. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Yamcs up to 5.12.6. This issue affects an unknown code block of the component Script Evaluation Engine. The manipulation with an unknown input leads to a sandbox vulnerability. Using CWE to declare the problem leads to CWE-265. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-46621 since 05/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/16/2026). The attack technique deployed by this issue is T1611 according to MITRE ATT&CK.

Upgrading to version 5.12.7 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Yamcs

Version

• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6

Website

• Product: https://github.com/yamcs/yamcs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion