---
cve: "CVE-2026-46562"
severity: "CRITICAL"
cvss: 9.8
epss: "78%"
vendor: "yamcs"
kev: false
exploited: false
published: "2026-07-16 17:16:56"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T06:40:48+02:00"
---

# CVE-2026-46562

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- 1262da4e2ffe7538d9ae4d6e7b22a345b3e1a2bb (Commit)
- 3c550348f866af4675d2ba4a51d8d12b7c7c6011 (Commit)

## Referenzen

- <https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75>
- <https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011>
- <https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992>
- <https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7>
- <https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-46562) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_