In short
- CVE-2026-55566 is a MEDIUM (CVSS 4.3) vulnerability affecting org.yamcs:yamcs-core.
- Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 32.0% of all vulnerabilities.
- Fix: update to 5.13.2, 5.12.8 or later.
| Package | Affected versions | Patched versions |
|---|
| org.yamcs:yamcs-core Maven | ≥ 5.13.0, < 5.13.2< 5.12.8
| 5.13.25.12.8
|
Description
Attack type: Unauthenticated remote
Impact: Execution of arbitrary JavaScript in a user’s browser.
Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.
<img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />
Steps to Reproduce:
- Start a Yamcs instance.
- Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject
- You will receive an alert with the number ‘1’ in it.
Recommendations:
- Use document.createElement instead of innerHTML in extension.component.ts.
- Validate the extension against registered plugin IDs.
- Enforce a strict custom-element-name regex before mounting.
NVD description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.
More vulnerabilities in org.yamcs:yamcs-core
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free