A critical code injection vulnerability in the Yamcs mission control framework allows remote attackers to achieve full system command execution.

The vulnerability stems from improper neutralization of template arguments in the VarStatement component, which fails to escape YAML content before processing. This flaw allows an attacker to inject a malicious ProcessRunner service entry, which is subsequently executed by the Yamcs server process.

Successful exploitation results in arbitrary command execution under the privileges of the Yamcs service account, leading to a complete compromise of the affected host. Given the CVSS score of 9.8, this vulnerability poses an extreme risk, as it facilitates unauthorized data access, system disruption, and the potential for lateral movement within the mission control environment.

Immediate Action: Upgrade to Yamcs version 5.12.8 or 5.13.2 immediately to apply the necessary YAML escaping fixes.

Proactive Monitoring: Monitor server logs and audit trails for unauthorized calls to the /api/instances endpoint and unusual process execution patterns originating from the Yamcs service account.

Compensating Controls: Ensure all deployments are secured with a strictly configured security.yaml file and restrict network access to the API endpoints using firewalls or mutual TLS authentication to prevent unauthorized interaction.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to operational continuity and system integrity. Administrators must prioritize the application of the vendor-provided patches as the primary defense. Given the severity of remote code execution, if patching is not immediately feasible, network-level segmentation must be enforced to isolate the Yamcs instance from untrusted traffic.