CVE-2026-46621 (GCVE-0-2026-46621)
Vulnerability from cvelistv5
Published
2026-07-16 16:07
Modified
2026-07-16 18:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46621",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:00:23.750726Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:00:50.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm\u0027s logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:07:38.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-2g95-6x5q-xjwj",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46621",
"datePublished": "2026-07-16T16:07:38.699Z",
"dateReserved": "2026-05-15T19:34:14.012Z",
"dateUpdated": "2026-07-16T18:00:50.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46621\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-16T18:00:23.750726Z\"}}}], \"references\": [{\"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-16T18:00:00.790Z\"}}], \"cna\": {\"title\": \"Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection\", \"source\": {\"advisory\": \"GHSA-2g95-6x5q-xjwj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"yamcs\", \"product\": \"yamcs\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.12.7\"}]}], \"references\": [{\"url\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj\", \"name\": \"https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011\", \"name\": \"https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992\", \"name\": \"https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7\", \"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0\", \"name\": \"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm\u0027s logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-16T16:07:38.699Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-46621\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-16T18:00:50.323Z\", \"dateReserved\": \"2026-05-15T19:34:14.012Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-16T16:07:38.699Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…