A critical code injection vulnerability in the Yamcs mission control framework allows authenticated attackers to execute arbitrary Java code with server privileges.

The flaw exists in the LikeExpression.fillCode_getValueReturn function, where unescaped input is passed to a compiler, allowing for Java code injection. This can be triggered by authenticated users through multiple API endpoints, including archive SQL execution and table reading operations.

The ability to execute arbitrary Java code on the Yamcs server process represents a total compromise of the application environment. Given the 9.9 CVSS score, this vulnerability poses a severe risk, as an attacker could gain full control over mission control operations, exfiltrate sensitive data, or disrupt critical infrastructure services.

Immediate Action: Update Yamcs to version 5.12.8 or 5.13.2 immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor API access logs for anomalous SQL patterns or unexpected requests to executeSql, streamSql, or table read endpoints.

Compensating Controls: Restrict API access to trusted users and implement strict input validation at the Web Application Firewall level to block suspicious characters like quotes or semicolons in SQL queries.

Public Exploit Available: No

This vulnerability carries a critical severity rating and requires immediate attention to prevent potential remote code execution. Security teams should prioritize patching affected instances of Yamcs to the specified secure versions to eliminate the code injection vector. Failure to remediate this issue could result in a complete loss of system integrity and unauthorized control over the mission control framework.