Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-2g95-6x5q-xjwj

Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

CVSS 9.1 CriticalCriticalEPSS 0.011 · 66th percentile

Critical, because:

  • CVSS score 9.1: 9.0 or more.

How we decide what’s critical

Published by the GitHub Advisory Database at 27 May 2026, 22:49 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
org.yamcs:yamcs-coreMaven<5.12.75.12.7
Identifiers
GHSA-2g95-6x5q-xjwj · CVE-2026-46621
Weakness (CWE)
CWE-94
Tags
Published
27 May 2026
Updated
27 May 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Yamcs (org.yamcs:yamcs-core, Maven) versions before 5.12.7 are vulnerable to remote code execution through algorithm code injection. An authenticated user holding the ChangeMissionDatabase privilege can overwrite a Python algorithm's logic through the REST API, and the Jython script engine then runs the injected code on the host operating system. Upgrade to yamcs-core 5.12.7 or later. Deployments that do not need the ChangeMissionDatabase privilege for some users can limit it to trusted administrators.

Written 3 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.1 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CNA (GitHub_M)
  • CISA KEV Not listed.
  • EPSS 0.011, the 66th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:20 UTC First seen by agentprime
  2. 31 Oct 2026, 14:20 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.