{"id":"CVE-2026-44632","summary":"Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`","details":"Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.","aliases":["GHSA-524g-x36v-9wm6"],"modified":"2026-07-22T04:28:39.306854Z","published":"2026-07-16T16:05:28.554Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44632.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44632.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44632"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yamcs/yamcs","events":[{"introduced":"0"},{"fixed":"1262da4e2ffe7538d9ae4d6e7b22a345b3e1a2bb"},{"fixed":"3c550348f866af4675d2ba4a51d8d12b7c7c6011"},{"fixed":"4ff8fda642ea8c3309a4d3f379aa77b763148992"},{"fixed":"8bf5af6fe227bbf8ead15e60644b7ddbf345d623"}],"database_specific":{"cpe":"cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.12.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["yamcs-5.12.6","yamcs-5.12.5","yamcs-5.12.4","yamcs-5.12.3","yamcs-5.12.2","yamcs-5.12.1","yamcs-5.12.0","yamcs-5.11.7","yamcs-5.9.8","yamcs-5.11.6","yamcs-5.11.5","yamcs-5.11.4","yamcs-5.10.9","yamcs-5.11.3","yamcs-5.11.2","yamcs-5.11.1","yamcs-5.11.0","yamcs-5.10.8","yamcs-5.10.7","yamcs-5.10.6","yamcs-5.10.5","yamcs-5.10.4","yamcs-5.10.3","yamcs-5.10.2","yamcs-5.10.1","yamcs-5.10.0","yamcs-5.9.7","yamcs-5.9.6","yamcs-5.9.5","yamcs-5.9.4","yamcs-5.9.3","yamcs-5.9.2","yamcs-5.9.1","yamcs-5.9.0","yamcs-5.8.8","yamcs-5.8.7","yamcs-5.8.6","yamcs-5.8.5","yamcs-5.8.4","yamcs-5.8.3","yamcs-5.8.2","yamcs-5.8.0","yamcs-5.8.1","yamcs-5.7.10","yamcs-5.7.9","yamcs-5.7.8","yamcs-5.7.7","yamcs-5.7.6","yamcs-5.7.5","yamcs-5.7.4","yamcs-5.7.3","yamcs-5.7.2","yamcs-5.7.1","yamcs-5.7.0","yamcs-5.6.2","yamcs-5.5.7","yamcs-5.6.1","yamcs-5.6.0","yamcs-5.5.6","before-removing-cfdp-half-implemented-features","yamcs-5.5.5","yamcs-5.5.4","yamcs-5.5.3","yamcs-5.5.2","yamcs-5.5.1","yamcs-5.5.0","yamcs-5.3.5","yamcs-5.4.3","yamcs-5.4.2","yamcs-5.4.1","yamcs-5.4.0","yamcs-5.2.0","yamcs-5.3.4","yamcs-5.3.3","yamcs-5.3.2","yamcs-5.3.1","yamcs-5.3.0","yamcs-5.1.3","yamcs-5.1.2","yamcs-5.1.1","yamcs-5.1.0","yamcs-5.0.1","yamcs-5.0.0","yamcs-4.10.9","yamcs-4.10.8","yamcs-4.10.7","yamcs-4.10.6","yamcs-4.10.5","yamcs-4.10.4","yamcs-4.10.3","yamcs-4.10.2","yamcs-4.10.1","yamcs-4.10.0","yamcs-4.9.5","yamcs-4.9.4","yamcs-4.9.3","yamcs-4.9.2","yamcs-4.9.1","yamcs-4.9.0","yamcs-4.8.1","yamcs-4.8.0","yamcs-4.7.3","yamcs-4.7.2","yamcs-4.7.1","yamcs-4.7","yamcs-4.4.2","yamcs-4.4.1","yamcs-4.4.0","yamcs-4.3.1","yamcs-4.3.0","yamcs-4.2.2","yamcs-4.2.1","yamcs-4.2.0","yamcs-4.1.2","yamcs-4.1.1","yamcs-4.0.1","yamcs-3.4.0","yamcs-3.3.0","yamcs-3.2.2","yamcs-3.2.1","yamcs-3.2.0","yamcs-3.1.2","yamcs-3.1.1","yamcs-3.1.0","yamcs-3.0.0","yamcs-0.30.0","v0.29.4","v0.29.3-20160608","v0.29.3","v0.29.1","v0.29.1-20160127","v0.29.1-20160119","v0.29.1-20151214","v0.29.0","v0.28.0","v0.28.0-20150903","v0.28.0-20150902-2","v0.28.0-20150902","v0.28.0-20150901","v0.28.0-20150828","v0.28.0-20150827","v0.28.0-20150826","v0.28.0-20150825","v0.28.0-20150824","v0.28.0-20150820","v0.28.0-20150817","v0.28.0-20150811","v0.26.1","v0.26.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/management/ManagementGpbHelper.java","function":"toProcessorInfo"},"deprecated":false,"digest":{"function_hash":"69355675553311376643589385243698277354","length":932},"id":"CVE-2026-44632-04f7a4d8","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/management/ManagementGpbHelper.java"},"deprecated":false,"digest":{"line_hashes":["118472431196787253798227417740529609675","227534305263495817904090678370684991051","302556645775454226571877765696569162178","101870416697812885281175895936987823145"],"threshold":0.9},"id":"CVE-2026-44632-0c0f33ed","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["241964768224116477582902244589299546982","264618694949394964591810732105671936051","243951618940424637021969782073687193567","191739151144059097785721734425842506822"],"threshold":0.9},"id":"CVE-2026-44632-14d16737","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaAlgorithmEngine.java"}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaExprAlgorithmExecutionFactory.java","function":"makeExecutor"},"deprecated":false,"digest":{"function_hash":"220339536036710192205152816864115849807","length":985},"id":"CVE-2026-44632-206fd7af","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/MethodNotAllowedException.java"},"deprecated":false,"digest":{"line_hashes":["213522417048489447241701557021121831056","234143975878213723898535080372481131947","296790635253047111773691550875626230709","136520459794390772046731156641227227837","244192829958875455441366520489480387708","25268749546252786537460022743686834267","145242089655594372309734656883358404204","258642614959399704284526605101622267718","72060053231437526835077110631347325575"],"threshold":0.9},"id":"CVE-2026-44632-2c173391","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"},{"source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/MethodNotAllowedException.java","function":"MethodNotAllowedException"},"deprecated":false,"digest":{"function_hash":"260610546637626123805002840882711416733","length":167},"id":"CVE-2026-44632-35c66300","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44632-3693809e","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/MethodNotAllowedException.java"},"deprecated":false,"digest":{"line_hashes":["213522417048489447241701557021121831056","234143975878213723898535080372481131947","296790635253047111773691550875626230709","136520459794390772046731156641227227837","244192829958875455441366520489480387708","25268749546252786537460022743686834267","145242089655594372309734656883358404204","258642614959399704284526605101622267718","72060053231437526835077110631347325575"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"69355675553311376643589385243698277354","length":932},"id":"CVE-2026-44632-4fdb4fbd","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/management/ManagementGpbHelper.java","function":"toProcessorInfo"}},{"source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaAlgorithmEngine.java","function":"makeExecutorFactory"},"deprecated":false,"digest":{"length":286,"function_hash":"297137259703460955890591782753343069421"},"id":"CVE-2026-44632-523c0cf3","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java","function":"updateAlgorithm"},"deprecated":false,"digest":{"function_hash":"175403622394224181677557170001566330023","length":1457},"id":"CVE-2026-44632-5349e9c2","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"220339536036710192205152816864115849807","length":985},"id":"CVE-2026-44632-612381e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaExprAlgorithmExecutionFactory.java","function":"makeExecutor"}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java"},"deprecated":false,"digest":{"line_hashes":["116879197966182653300641218375797722160","269589951678138429283507016451010003912","95678968355699007854897787606507491205","136571010188212296716841914283842932502","55611388841657817681863264570128896904","213383566593331879331805975679889274964","50071560271865428154558529131891505009","286314923178870231391490119533903382494","292290321104374562557050320643769905310","283146188330103590308974444058737040632","102348920905366318743752617118356945540","246584551490247390194164403492194433061","243335454619869312221313109743921216343","126636625686844119497204723182823984261","165613062703332532150763729313052063047","52829834940496467358929413767387663117","14882860157474640720836206264010067111","241569034141604689740120675869394275477","29403360697770534985431426799854614051","35822338048705794528421113291566706416"],"threshold":0.9},"id":"CVE-2026-44632-6e03a7d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java","function":"updateAlgorithm"},"deprecated":false,"digest":{"length":1457,"function_hash":"175403622394224181677557170001566330023"},"id":"CVE-2026-44632-70afa7e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaExprAlgorithmExecutionFactory.java"},"deprecated":false,"digest":{"line_hashes":["161398523729895336014706138350641318553","273220274344893915142642825170251883527","48506070067915461587706010341681522907","17224658079551879234134642541021083385","154111289746572360652317409728122795556","235406883681263632732240869220442004585","248375046485230268078905611178863315395","107823101378711850844522202333308755219"],"threshold":0.9},"id":"CVE-2026-44632-70ea5aac","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java","function":"ProcessorConfig"},"deprecated":false,"digest":{"function_hash":"310190026549143569023136059797516033463","length":1817},"id":"CVE-2026-44632-8b21ebc1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java","function":"getSpec"},"deprecated":false,"digest":{"function_hash":"125739421591477469292252992573794845728","length":1276},"id":"CVE-2026-44632-8c4feb75"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java","function":"ProcessorConfig"},"deprecated":false,"digest":{"function_hash":"310190026549143569023136059797516033463","length":1817},"id":"CVE-2026-44632-8f9038b5"},{"id":"CVE-2026-44632-a0541487","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaAlgorithmEngine.java"},"deprecated":false,"digest":{"line_hashes":["241964768224116477582902244589299546982","264618694949394964591810732105671936051","243951618940424637021969782073687193567","191739151144059097785721734425842506822"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/MethodNotAllowedException.java","function":"MethodNotAllowedException"},"deprecated":false,"digest":{"function_hash":"260610546637626123805002840882711416733","length":167},"id":"CVE-2026-44632-a57e58e0","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["275675998073552014589457695235223354736","243292281897350605820333332665474372045","159920416838663192370557722461744309802","296524083713015601103628216142848717481","71343476542026263028502927347429551607","138254179028667012550324752460260128139","308091913777530617795881085649730092866","197368091857767893483598795932471677791","68779081931427277189682738499459662324","315344999381674866719205285454525321052","125025447958032509055844866081243052765","45124006906409455888882639398851057809","251788913655107564963074641647600355754","16264177457412682665257442453032609666","272829936388159473589666872571130738229","82152106211157360190784365681138671197","161696270339652931536471880449971489993","328062286430530347737984268037828921179","187151550577727158485090025753362876365"],"threshold":0.9},"id":"CVE-2026-44632-c3e00ba6","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java"}},{"digest":{"threshold":0.9,"line_hashes":["275675998073552014589457695235223354736","243292281897350605820333332665474372045","159920416838663192370557722461744309802","296524083713015601103628216142848717481","71343476542026263028502927347429551607","138254179028667012550324752460260128139","308091913777530617795881085649730092866","197368091857767893483598795932471677791","68779081931427277189682738499459662324","315344999381674866719205285454525321052","125025447958032509055844866081243052765","45124006906409455888882639398851057809","251788913655107564963074641647600355754","16264177457412682665257442453032609666","272829936388159473589666872571130738229","82152106211157360190784365681138671197","161696270339652931536471880449971489993","328062286430530347737984268037828921179","187151550577727158485090025753362876365"]},"id":"CVE-2026-44632-cc915c84","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java"},"deprecated":false},{"target":{"function":"getSpec","file":"yamcs-core/src/main/java/org/yamcs/ProcessorConfig.java"},"deprecated":false,"digest":{"function_hash":"125739421591477469292252992573794845728","length":1276},"id":"CVE-2026-44632-dc6482d5","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java"},"deprecated":false,"digest":{"line_hashes":["116879197966182653300641218375797722160","269589951678138429283507016451010003912","95678968355699007854897787606507491205","136571010188212296716841914283842932502","55611388841657817681863264570128896904","213383566593331879331805975679889274964","50071560271865428154558529131891505009","286314923178870231391490119533903382494","292290321104374562557050320643769905310","283146188330103590308974444058737040632","102348920905366318743752617118356945540","246584551490247390194164403492194433061","243335454619869312221313109743921216343","126636625686844119497204723182823984261","165613062703332532150763729313052063047","52829834940496467358929413767387663117","14882860157474640720836206264010067111","241569034141604689740120675869394275477","29403360697770534985431426799854614051","35822338048705794528421113291566706416"],"threshold":0.9},"id":"CVE-2026-44632-de5ec556","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaAlgorithmEngine.java","function":"makeExecutorFactory"},"deprecated":false,"digest":{"function_hash":"297137259703460955890591782753343069421","length":286},"id":"CVE-2026-44632-e64180a1"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992","target":{"file":"yamcs-core/src/main/java/org/yamcs/management/ManagementGpbHelper.java"},"deprecated":false,"digest":{"line_hashes":["118472431196787253798227417740529609675","227534305263495817904090678370684991051","302556645775454226571877765696569162178","101870416697812885281175895936987823145"],"threshold":0.9},"id":"CVE-2026-44632-f79102af","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011","target":{"file":"yamcs-core/src/main/java/org/yamcs/algorithms/JavaExprAlgorithmExecutionFactory.java"},"deprecated":false,"digest":{"line_hashes":["161398523729895336014706138350641318553","273220274344893915142642825170251883527","48506070067915461587706010341681522907","17224658079551879234134642541021083385","154111289746572360652317409728122795556","235406883681263632732240869220442004585","248375046485230268078905611178863315395","107823101378711850844522202333308755219"],"threshold":0.9},"id":"CVE-2026-44632-fc557303","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44632.json","vanir_signatures_modified":"2026-07-22T04:28:39Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}