Yamcs StreamSQL LIKE Injection Enables Authenticated RCE via Janino Compilation (CVE-2026-55565)

What happened

A GitHub Security Advisory (GHSA-c64q-hj4j-375f) discloses CVE-2026-55565, a critical (CVSS 9.9) remote code execution vulnerability in org.yamcs:yamcs-core, the open-source satellite mission control framework. According to the advisory, Yamcs compiles StreamSQL query expressions to Java at runtime using the Janino compiler, and the LIKE operator inserts user-supplied patterns into the generated Java source without escaping. A pattern containing a " character can break out of the string literal and inject arbitrary Java, including a static{} block that executes an OS command when the compiled class loads.

The advisory states the sink is reachable not only from executeSql/streamSql (which require the ControlArchiving privilege) but also from lower-privilege, read-only endpoints: readRows (ReadTables), the events list/export/stream endpoints (ReadEvents), and listActivities (ReadActivities) — including the Events page search box in the UI. A public proof-of-concept demonstrating command execution via a crafted LIKE pattern is included in the advisory.

Why it matters for defenders

Per the advisory, exploitation requires only a low-privilege, read-only account — not an administrative or mission-database-control role — and results in arbitrary OS command execution as the user running Yamcs. Yamcs is used in satellite and mission control operations, so the reported impact includes telecommand injection/suppression, telemetry tampering, credential and filesystem access, and lateral movement. The advisory also notes that exploitation via executeSql generates no Yamcs event and is not audit-logged, which the authors flag as a detection gap. The advisory explicitly states this issue is independent of the earlier May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632) and does not depend on the overrideAlgorithmsEnabled gate.

What defenders should watch for or do now

• Identify any Yamcs deployments (self-hosted or managed) and check the affected component, org.yamcs:yamcs-core, against the fix once a patched release is available from the vendor.
• Review authentication and privilege assignment for Yamcs users — the advisory indicates that routine read-only roles (ReadTables, ReadEvents, ReadActivities) are sufficient to reach the vulnerable code path, so privilege minimization alone will not fully mitigate this.
• Monitor HTTP access logs for Yamcs API endpoints (:executeSql, :streamSql, :readRows, /events, activities listing) for requests containing unusual characters in query/search parameters, particularly unescaped double quotes in fields that populate LIKE clauses.
• Watch for unexpected child processes spawned by the Yamcs server process, and for unexplained tables/streams created via executeSql, since the advisory notes this exploitation path may not appear in Yamcs's own audit events.
• Where feasible, restrict outbound network and process-execution capability for the account running Yamcs as a defense-in-depth measure while awaiting a patch.

Developing intel

This is a same-day advisory and details may evolve as the vendor responds and a fix is released. This analysis is based solely on the GitHub Security Advisory; readers should consult the source directly for the latest status, patched versions, and any vendor guidance: GHSA-c64q-hj4j-375f.