{"id":"CVE-2026-55565","summary":"Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)","details":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.","aliases":["GHSA-c64q-hj4j-375f"],"modified":"2026-08-30T08:17:20.805099Z","published":"2026-08-28T17:29:56.768Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55565.json"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55565.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55565"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yamcs/yamcs","events":[{"introduced":"0"},{"introduced":"8bf5af6fe227bbf8ead15e60644b7ddbf345d623"},{"fixed":"144335f15d7730d7fc833122c8c8a6f1906fea9f"},{"fixed":"50d73a44d136f0dd2828fa11f69f1fe1fc5583f7"},{"fixed":"640e1598b7097b521692e89dd47a39b6cb1fc663"},{"fixed":"a8fb4a0693fa62a6eb729b26016d1090dd8b289c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.12.8"},{"introduced":"5.13.0"},{"fixed":"5.13.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["yamcs-5.13.1","yamcs-5.13.0","yamcs-5.12.7","yamcs-5.12.6","yamcs-5.12.5","yamcs-5.12.4","yamcs-5.12.3","yamcs-5.12.2","yamcs-5.12.1","yamcs-5.12.0","yamcs-5.11.7","yamcs-5.9.8","yamcs-5.11.6","yamcs-5.11.5","yamcs-5.11.4","yamcs-5.10.9","yamcs-5.11.3","yamcs-5.11.2","yamcs-5.11.1","yamcs-5.11.0","yamcs-5.10.8","yamcs-5.10.7","yamcs-5.10.6","yamcs-5.10.5","yamcs-5.10.4","yamcs-5.10.3","yamcs-5.10.2","yamcs-5.10.1","yamcs-5.10.0","yamcs-5.9.7","yamcs-5.9.6","yamcs-5.9.5","yamcs-5.9.4","yamcs-5.9.3","yamcs-5.9.2","yamcs-5.9.1","yamcs-5.9.0","yamcs-5.8.8","yamcs-5.8.7","yamcs-5.8.6","yamcs-5.8.5","yamcs-5.8.4","yamcs-5.8.3","yamcs-5.8.2","yamcs-5.8.0","yamcs-5.8.1","yamcs-5.7.10","yamcs-5.7.9","yamcs-5.7.8","yamcs-5.7.7","yamcs-5.7.6","yamcs-5.7.5","yamcs-5.7.4","yamcs-5.7.3","yamcs-5.7.2","yamcs-5.7.1","yamcs-5.7.0","yamcs-5.6.2","yamcs-5.5.7","yamcs-5.6.1","yamcs-5.6.0","yamcs-5.5.6","before-removing-cfdp-half-implemented-features","yamcs-5.5.5","yamcs-5.5.4","yamcs-5.5.3","yamcs-5.5.2","yamcs-5.5.1","yamcs-5.5.0","yamcs-5.3.5","yamcs-5.4.3","yamcs-5.4.2","yamcs-5.4.1","yamcs-5.4.0","yamcs-5.2.0","yamcs-5.3.4","yamcs-5.3.3","yamcs-5.3.2","yamcs-5.3.1","yamcs-5.3.0","yamcs-5.1.3","yamcs-5.1.2","yamcs-5.1.1","yamcs-5.1.0","yamcs-5.0.1","yamcs-5.0.0","yamcs-4.10.9","yamcs-4.10.8","yamcs-4.10.7","yamcs-4.10.6","yamcs-4.10.5","yamcs-4.10.4","yamcs-4.10.3","yamcs-4.10.2","yamcs-4.10.1","yamcs-4.10.0","yamcs-4.9.5","yamcs-4.9.4","yamcs-4.9.3","yamcs-4.9.2","yamcs-4.9.1","yamcs-4.9.0","yamcs-4.8.1","yamcs-4.8.0","yamcs-4.7.3","yamcs-4.7.2","yamcs-4.7.1","yamcs-4.7","yamcs-4.4.2","yamcs-4.4.1","yamcs-4.4.0","yamcs-4.3.1","yamcs-4.3.0","yamcs-4.2.2","yamcs-4.2.1","yamcs-4.2.0","yamcs-4.1.2","yamcs-4.1.1","yamcs-4.0.1","yamcs-3.4.0","yamcs-3.3.0","yamcs-3.2.2","yamcs-3.2.1","yamcs-3.2.0","yamcs-3.1.2","yamcs-3.1.1","yamcs-3.1.0","yamcs-3.0.0","yamcs-0.30.0","v0.29.4","v0.29.3-20160608","v0.29.3","v0.29.1","v0.29.1-20160127","v0.29.1-20160119","v0.29.1-20151214","v0.29.0","v0.28.0","v0.28.0-20150903","v0.28.0-20150902-2","v0.28.0-20150902","v0.28.0-20150901","v0.28.0-20150828","v0.28.0-20150827","v0.28.0-20150826","v0.28.0-20150825","v0.28.0-20150824","v0.28.0-20150820","v0.28.0-20150817","v0.28.0-20150811","v0.26.1","v0.26.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55565.json","vanir_signatures_modified":"2026-08-30T08:17:20Z","vanir_signatures":[{"target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java","function":"fillCode_getValueReturn"},"deprecated":false,"digest":{"function_hash":"109694333611445799174495950576646993564","length":324},"id":"CVE-2026-55565-5b5a194a","signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"},{"digest":{"line_hashes":["74030761015641808633311996075843395779","200439767841679564929251551900160647920","58682809980995283352545013263392119795","320470183032229987541704171356531658108"],"threshold":0.9},"id":"CVE-2026-55565-9d7f838a","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/ValueExpression.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java","function":"fillCode_getValueReturn"},"deprecated":false,"digest":{"length":324,"function_hash":"109694333611445799174495950576646993564"},"id":"CVE-2026-55565-9f642589"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java"},"deprecated":false,"digest":{"line_hashes":["339221385453016234574088354950219402420","216722659411431594588992763513749702346","50734789007950990947290151192849563725","264113066181750728922849196332692127551"],"threshold":0.9},"id":"CVE-2026-55565-bd985f28","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"},{"deprecated":false,"digest":{"line_hashes":["74030761015641808633311996075843395779","200439767841679564929251551900160647920","58682809980995283352545013263392119795","320470183032229987541704171356531658108"],"threshold":0.9},"id":"CVE-2026-55565-d0f9daa7","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/ValueExpression.java"}},{"id":"CVE-2026-55565-fbf48694","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663","target":{"file":"yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java"},"deprecated":false,"digest":{"line_hashes":["339221385453016234574088354950219402420","216722659411431594588992763513749702346","50734789007950990947290151192849563725","264113066181750728922849196332692127551"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}