{"id":"CVE-2026-55511","summary":"Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`","details":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.","aliases":["GHSA-3g44-3m7x-cgg2"],"modified":"2026-09-10T08:13:50.900853Z","published":"2026-08-28T17:05:02.307Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55511.json"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55511.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55511"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yamcs/yamcs","events":[{"introduced":"0"},{"introduced":"8bf5af6fe227bbf8ead15e60644b7ddbf345d623"},{"fixed":"144335f15d7730d7fc833122c8c8a6f1906fea9f"},{"fixed":"50d73a44d136f0dd2828fa11f69f1fe1fc5583f7"},{"fixed":"8c1070b12c0a6c003903325cb2a1013347e2dbde"},{"fixed":"b65a3d78178ba99a58b753feda6ecc3b5a694f13"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"5.12.8"},{"introduced":"5.13.0"},{"fixed":"5.13.2"}]}}],"versions":["yamcs-5.13.1","yamcs-5.13.0","yamcs-5.12.7","yamcs-5.12.6","yamcs-5.12.5","yamcs-5.12.4","yamcs-5.12.3","yamcs-5.12.2","yamcs-5.12.1","yamcs-5.12.0","yamcs-5.11.7","yamcs-5.9.8","yamcs-5.11.6","yamcs-5.11.5","yamcs-5.11.4","yamcs-5.10.9","yamcs-5.11.3","yamcs-5.11.2","yamcs-5.11.1","yamcs-5.11.0","yamcs-5.10.8","yamcs-5.10.7","yamcs-5.10.6","yamcs-5.10.5","yamcs-5.10.4","yamcs-5.10.3","yamcs-5.10.2","yamcs-5.10.1","yamcs-5.10.0","yamcs-5.9.7","yamcs-5.9.6","yamcs-5.9.5","yamcs-5.9.4","yamcs-5.9.3","yamcs-5.9.2","yamcs-5.9.1","yamcs-5.9.0","yamcs-5.8.8","yamcs-5.8.7","yamcs-5.8.6","yamcs-5.8.5","yamcs-5.8.4","yamcs-5.8.3","yamcs-5.8.2","yamcs-5.8.0","yamcs-5.8.1","yamcs-5.7.10","yamcs-5.7.9","yamcs-5.7.8","yamcs-5.7.7","yamcs-5.7.6","yamcs-5.7.5","yamcs-5.7.4","yamcs-5.7.3","yamcs-5.7.2","yamcs-5.7.1","yamcs-5.7.0","yamcs-5.6.2","yamcs-5.5.7","yamcs-5.6.1","yamcs-5.6.0","yamcs-5.5.6","before-removing-cfdp-half-implemented-features","yamcs-5.5.5","yamcs-5.5.4","yamcs-5.5.3","yamcs-5.5.2","yamcs-5.5.1","yamcs-5.5.0","yamcs-5.3.5","yamcs-5.4.3","yamcs-5.4.2","yamcs-5.4.1","yamcs-5.4.0","yamcs-5.2.0","yamcs-5.3.4","yamcs-5.3.3","yamcs-5.3.2","yamcs-5.3.1","yamcs-5.3.0","yamcs-5.1.3","yamcs-5.1.2","yamcs-5.1.1","yamcs-5.1.0","yamcs-5.0.1","yamcs-5.0.0","yamcs-4.10.9","yamcs-4.10.8","yamcs-4.10.7","yamcs-4.10.6","yamcs-4.10.5","yamcs-4.10.4","yamcs-4.10.3","yamcs-4.10.2","yamcs-4.10.1","yamcs-4.10.0","yamcs-4.9.5","yamcs-4.9.4","yamcs-4.9.3","yamcs-4.9.2","yamcs-4.9.1","yamcs-4.9.0","yamcs-4.8.1","yamcs-4.8.0","yamcs-4.7.3","yamcs-4.7.2","yamcs-4.7.1","yamcs-4.7","yamcs-4.4.2","yamcs-4.4.1","yamcs-4.4.0","yamcs-4.3.1","yamcs-4.3.0","yamcs-4.2.2","yamcs-4.2.1","yamcs-4.2.0","yamcs-4.1.2","yamcs-4.1.1","yamcs-4.0.1","yamcs-3.4.0","yamcs-3.3.0","yamcs-3.2.2","yamcs-3.2.1","yamcs-3.2.0","yamcs-3.1.2","yamcs-3.1.1","yamcs-3.1.0","yamcs-3.0.0","yamcs-0.30.0","v0.29.4","v0.29.3-20160608","v0.29.3","v0.29.1","v0.29.1-20160127","v0.29.1-20160119","v0.29.1-20151214","v0.29.0","v0.28.0","v0.28.0-20150903","v0.28.0-20150902-2","v0.28.0-20150902","v0.28.0-20150901","v0.28.0-20150828","v0.28.0-20150827","v0.28.0-20150826","v0.28.0-20150825","v0.28.0-20150824","v0.28.0-20150820","v0.28.0-20150817","v0.28.0-20150811","v0.26.1","v0.26.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["225812273844396893110855229746068492278","15471659698534323165734542850707999339","321772889622913741531156658364806129053","53487420292345727546099382695028555295","54566271027313603977927294634332993730","196852116043937285830466880104445557872","107312989833239024258655412938932807270","138358310734320292324517063372289566498","270802938603388538814275432271719886947","36107302190907108781242651272318605856","137910692055040963236236128137656422035","249064551546678915054327492060210063354","91546866314283215190243349691165915250","46869859369639164389977505175367711200","109537916874942138688706165430441878086","222294658685442673575841575050276871885","1489756098390374504602054859245250748","302154594170448428976927767785865298134","240955959495842567035048661547359251535","271426528880471998868430287252449017283","70001217067725042866759447800031218709","320932466540947056017662240958264056011"],"threshold":0.9},"id":"CVE-2026-55511-1ad2925d","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParserTokenManager.java"}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde","target":{"file":"yamcs-core/src/test/java/org/yamcs/yarch/TableUpdateTest.java","function":"testInvalidTable"},"deprecated":false,"digest":{"function_hash":"274247476868055766400124730894820271198","length":123},"id":"CVE-2026-55511-2a99e57c","signature_type":"Function"},{"digest":{"line_hashes":["25181148832703404370806396615554998122","52538422421918085488032818318466968857","335500661531046826596037928724811888355","63675628522053480693222408308793874401","88919675479759595579578826625906619026","155754908899599117213771779125165845862","174328736460351682001798210434395773696","127766797326955697587617705139129766263","109018763820126416152611903655724139479","333522852310294492861575505107878159854","185698108624357113566548903749407816742","167884131903306272786710082354646750078","309668493968869658623460949288687230936","141832095867895342951997596360792361377","317355577057689303833402304756535745277","23338668591475095242532153307240193645","189260659484162229115973293765507923614","125406914363016844355989823775883628687","277573688307522803476549829153510555722","270063916535126167167199229867225004147","111208030882180229786737708039438301787","170513252682204287152725941821415099388","82734911118955714408726531923649895443","177584807555463662863936044518079540277","320921104286515683674803458295927725470","310969205053242639563253759219114006940","303733064976878702313223822562023671658","323179371126554312468297853131399679798","327299742985531383195700190153179023509","146848382205376249660845550460306275168","72882221246812747572897623547313126653","4398739121386886198963856111804399188","82602102619637290622494579332925207549","21887654550910503342088085776855034834","237028961281263959877148851113422986394","194272197076947466639453260289165478703","113796687313714931241458001248013389208","291100348347786045348570514628084044865","152316203400889723508093293462131523495","239837924403100707996397339295599627924","100648710660902602658521283282685527883","76631114455375829531869925441787463510","267865401831170839381261183202091198611","2487210164277490269083371441183723254","106947200550495206468436448473022433846","260126836222414078731685785877239933251","131235770016732270900089587698491814090","18518957715215584434696295350090982145","339611980986442639872559963416171568592","189317654390315449067167702797101862835","104067162401168741199022983473678695821","324735418433065798432679759027497532993","45632492039523594214188433380418640575","84362291708490454358326774837130907521","332757295506936509694528900585935142921","80524563996058437596037566620687566332","295907680589066568462493662964472760617","185570953918221850243682212287272051120","230300849331190711274782233986924822855","292934256020791687512689196244027717911","316626832543222728199371476471673768161","63468040239107293698495587884761048762","333701510792638919228025943518887668234","68818645590412367622564991256945939848","154765705121967060647949815999296917160","242705956767458707222613463070873713439","45327228296127656652876077889456037933","44404899007943106875448636134685688198","58135152759915797646929647240782000316","33466531110294329020706173856933227823","50459450222244906233962341377105000756","132187745551794034826451093601289550915","265946881456273840506369042085037512343","247325284835002848116732572316109405694","175138853630817929974448410292421109550","233070271241609836550875511514068679588","271825847295986282055917194985334045282","238453265605885471050832066348395718968","105008253345016478446861197238799112946","38449821946893698823433879415669808147","75350939764613373195205552531380820977","270449924040855075482396249496448949952","64282770159072939455693536608725380028","252720835688435143325245624275872046649","81942550637799181070004338968084976033","299080691706237075877418895180309182606","314455288620770565157610202888603289542","288875086991696649192881869762205127372","97129317872946452040271859572877744207","144619704561972520633027636913412368871","121874262361304756504709200102111134721","18649992352359502531284503690873963155","164165481051309579304293882639209929311","320055296048413477633363664630010436752","69393022501752465387505100462969682560","335422462503059869314275070400297859333","209089570033359406618076964872538640428","274033266049415191817832446260784746558","128745623381475338730051399471419926700","279811313746069153353448207967813092811","193302108129796779598442271319278150260","224949862048196874159986430986405718015","119961797731791740588305395922929782586","201936482709976873956812712584125947005","320741980977386524470347013176645835142","112462340543883284654661366515977396030","165144570662501558668354779652574777839","51959788608763283795962529440077615499","240310532357624898306717586153058694851","61750957127827562506637217328832200839","129274399950800928568437528993473414354","199169839091341417738949513433793856312","298456371185709917643546984973304822926","111519636374743601632496592862071008658","326806705330013330550336647654522713618","14000596613453499272292109583451383932","284100818284279369239064277190270785757","173981953277819623457412141472141553601","164666317199265775684650359575221349661","146525962134119861716485185510456415948","40276771383880574862959674444774781114","71186522375808375110677404851481112575","210885666658727072488618908735306897638","76987292452860536161060910993069066230","242217174335940403642700679221495321106","142038494859193303372468994989692771378"],"threshold":0.9},"id":"CVE-2026-55511-3cb4241d","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParser.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/test/java/org/yamcs/yarch/TableUpdateTest.java"},"deprecated":false,"digest":{"line_hashes":["143959788592565662493879229429152199277","274328253114383696207640756596968035126","106635634319221905010994822652955796665","216021891415079964250350948280342546379"],"threshold":0.9},"id":"CVE-2026-55511-46a7a1d1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["143959788592565662493879229429152199277","274328253114383696207640756596968035126","106635634319221905010994822652955796665","216021891415079964250350948280342546379"]},"id":"CVE-2026-55511-65d527db","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde","target":{"file":"yamcs-core/src/test/java/org/yamcs/yarch/TableUpdateTest.java"}},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParser.java","function":"jj_add_error_token"},"deprecated":false,"digest":{"function_hash":"202979370690166219050648042709157295383","length":805},"id":"CVE-2026-55511-72090825","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParser.java","function":"jj_add_error_token"},"deprecated":false,"digest":{"function_hash":"202979370690166219050648042709157295383","length":805},"id":"CVE-2026-55511-7bd3e239"},{"id":"CVE-2026-55511-7e71d5df","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParser.java"},"deprecated":false,"digest":{"line_hashes":["25181148832703404370806396615554998122","52538422421918085488032818318466968857","335500661531046826596037928724811888355","63675628522053480693222408308793874401","88919675479759595579578826625906619026","155754908899599117213771779125165845862","174328736460351682001798210434395773696","127766797326955697587617705139129766263","109018763820126416152611903655724139479","333522852310294492861575505107878159854","185698108624357113566548903749407816742","167884131903306272786710082354646750078","309668493968869658623460949288687230936","141832095867895342951997596360792361377","317355577057689303833402304756535745277","23338668591475095242532153307240193645","189260659484162229115973293765507923614","125406914363016844355989823775883628687","277573688307522803476549829153510555722","270063916535126167167199229867225004147","111208030882180229786737708039438301787","170513252682204287152725941821415099388","82734911118955714408726531923649895443","177584807555463662863936044518079540277","320921104286515683674803458295927725470","310969205053242639563253759219114006940","303733064976878702313223822562023671658","323179371126554312468297853131399679798","327299742985531383195700190153179023509","146848382205376249660845550460306275168","72882221246812747572897623547313126653","4398739121386886198963856111804399188","82602102619637290622494579332925207549","21887654550910503342088085776855034834","237028961281263959877148851113422986394","194272197076947466639453260289165478703","113796687313714931241458001248013389208","291100348347786045348570514628084044865","152316203400889723508093293462131523495","239837924403100707996397339295599627924","100648710660902602658521283282685527883","76631114455375829531869925441787463510","267865401831170839381261183202091198611","2487210164277490269083371441183723254","106947200550495206468436448473022433846","260126836222414078731685785877239933251","131235770016732270900089587698491814090","18518957715215584434696295350090982145","339611980986442639872559963416171568592","189317654390315449067167702797101862835","104067162401168741199022983473678695821","324735418433065798432679759027497532993","45632492039523594214188433380418640575","84362291708490454358326774837130907521","332757295506936509694528900585935142921","80524563996058437596037566620687566332","295907680589066568462493662964472760617","185570953918221850243682212287272051120","230300849331190711274782233986924822855","292934256020791687512689196244027717911","316626832543222728199371476471673768161","63468040239107293698495587884761048762","333701510792638919228025943518887668234","68818645590412367622564991256945939848","154765705121967060647949815999296917160","242705956767458707222613463070873713439","45327228296127656652876077889456037933","44404899007943106875448636134685688198","58135152759915797646929647240782000316","33466531110294329020706173856933227823","50459450222244906233962341377105000756","132187745551794034826451093601289550915","265946881456273840506369042085037512343","247325284835002848116732572316109405694","175138853630817929974448410292421109550","233070271241609836550875511514068679588","271825847295986282055917194985334045282","238453265605885471050832066348395718968","105008253345016478446861197238799112946","38449821946893698823433879415669808147","75350939764613373195205552531380820977","270449924040855075482396249496448949952","64282770159072939455693536608725380028","252720835688435143325245624275872046649","81942550637799181070004338968084976033","299080691706237075877418895180309182606","314455288620770565157610202888603289542","288875086991696649192881869762205127372","97129317872946452040271859572877744207","144619704561972520633027636913412368871","121874262361304756504709200102111134721","18649992352359502531284503690873963155","164165481051309579304293882639209929311","320055296048413477633363664630010436752","69393022501752465387505100462969682560","335422462503059869314275070400297859333","209089570033359406618076964872538640428","274033266049415191817832446260784746558","128745623381475338730051399471419926700","279811313746069153353448207967813092811","193302108129796779598442271319278150260","224949862048196874159986430986405718015","119961797731791740588305395922929782586","201936482709976873956812712584125947005","320741980977386524470347013176645835142","112462340543883284654661366515977396030","165144570662501558668354779652574777839","51959788608763283795962529440077615499","240310532357624898306717586153058694851","61750957127827562506637217328832200839","129274399950800928568437528993473414354","199169839091341417738949513433793856312","298456371185709917643546984973304822926","111519636374743601632496592862071008658","326806705330013330550336647654522713618","14000596613453499272292109583451383932","284100818284279369239064277190270785757","173981953277819623457412141472141553601","164666317199265775684650359575221349661","146525962134119861716485185510456415948","40276771383880574862959674444774781114","71186522375808375110677404851481112575","210885666658727072488618908735306897638","76987292452860536161060910993069066230","242217174335940403642700679221495321106","142038494859193303372468994989692771378"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParserTokenManager.java","function":"jjMoveNfa_0"},"deprecated":false,"digest":{"length":5757,"function_hash":"200338772070400953765882606812637615466"},"id":"CVE-2026-55511-d2b086a1","signature_type":"Function"},{"source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParserTokenManager.java"},"deprecated":false,"digest":{"line_hashes":["225812273844396893110855229746068492278","15471659698534323165734542850707999339","321772889622913741531156658364806129053","53487420292345727546099382695028555295","54566271027313603977927294634332993730","196852116043937285830466880104445557872","107312989833239024258655412938932807270","138358310734320292324517063372289566498","270802938603388538814275432271719886947","36107302190907108781242651272318605856","137910692055040963236236128137656422035","249064551546678915054327492060210063354","91546866314283215190243349691165915250","46869859369639164389977505175367711200","109537916874942138688706165430441878086","222294658685442673575841575050276871885","1489756098390374504602054859245250748","302154594170448428976927767785865298134","240955959495842567035048661547359251535","271426528880471998868430287252449017283","70001217067725042866759447800031218709","320932466540947056017662240958264056011"],"threshold":0.9},"id":"CVE-2026-55511-ec76630b","signature_type":"Line","signature_version":"v1"},{"digest":{"length":5757,"function_hash":"200338772070400953765882606812637615466"},"id":"CVE-2026-55511-ee55eff5","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/StreamSqlParserTokenManager.java","function":"jjMoveNfa_0"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13","target":{"file":"yamcs-core/src/test/java/org/yamcs/yarch/TableUpdateTest.java","function":"testInvalidTable"},"deprecated":false,"digest":{"function_hash":"274247476868055766400124730894820271198","length":123},"id":"CVE-2026-55511-fb605962","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55511.json","vanir_signatures_modified":"2026-09-10T08:13:50Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}