Em resumo
- CVE-2026-55566 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta org.yamcs:yamcs-core.
- Chance de exploração nos próximos 30 dias (EPSS): 0.38%, maior que 32.0% das vulnerabilidades.
- Correção: atualize para 5.13.2, 5.12.8 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| org.yamcs:yamcs-core Maven | ≥ 5.13.0, < 5.13.2< 5.12.8
| 5.13.25.12.8
|
Description
Attack type: Unauthenticated remote
Impact: Execution of arbitrary JavaScript in a user’s browser.
Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.
<img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />
Steps to Reproduce:
- Start a Yamcs instance.
- Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject
- You will receive an alert with the number ‘1’ in it.
Recommendations:
- Use document.createElement instead of innerHTML in extension.component.ts.
- Validate the extension against registered plugin IDs.
- Enforce a strict custom-element-name regex before mounting.
NVD description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.
Mais vulnerabilidades de org.yamcs:yamcs-core
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free