PT-2026-44162 · Maven+3 · Org.Yamcs:Yamcs-Core+1

CVE-2026-46621 · Published 2026-05-27 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.7

Description A server-side code injection issue exists in the Yamcs script evaluation engine for Python algorithms. The application dynamically compiles and evaluates user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox. An authenticated user with the ChangeMissionDatabase privilege can override an existing Python algorithm's logic via the REST API endpoint /api/mdb/{instance}/realtime/algorithms/{name}. By importing and executing arbitrary Java classes, such as java.lang.Runtime, an attacker can achieve remote code execution on the underlying host operating system. This is possible because Jython allows seamless interoperability with native Java classes.

Recommendations Update to version 5.12.7 or 5.13.0. As a temporary mitigation, restrict the ChangeMissionDatabase privilege to only highly trusted users to prevent unauthorized modification of algorithm logic.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-46621

GHSA-2G95-6X5Q-XJWJ

Affected Products

Org.Yamcs:Yamcs-Core

Yamcs

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46621.json · Exploit
• 🔥 https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj · Exploit
• https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992 · Patch
• https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011 · Patch
• https://osv.dev/vulnerability/CVE-2026-46621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46621 · Security Note
• https://osv.dev/vulnerability/GHSA-2g95-6x5q-xjwj · Vendor Advisory
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 · Note
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 · Note
• https://github.com/yamcs/yamcs · Note
• https://reddit.com/r/VulnMatter/comments/1tqerun/resumen_diario_de_vulnerabilidades_28052026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1tqmcvv/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://t.me/cveNotify/206791 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1tr0f8l/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post