{"schema":"threatline.record/2","record":{"id":"CVE-2026-55566","aliases":["GHSA-9272-wg2r-7xmx"],"summary":"Yamcs has DOM XSS in Extension Routing","details":"**Attack type**: Unauthenticated remote \n**Impact**: Execution of arbitrary JavaScript in a user’s browser.\n**Affected components**: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.\n\nYamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.\n \n<img width=\"940\" height=\"294\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e\" />\n\nSteps to Reproduce:\n1.\tStart a Yamcs instance.\n2.\tInsert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):\n```\nhttp://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject\n```\n3.\tYou will receive an alert with the number ‘1’ in it.\n\nRecommendations:\n1.\tUse document.createElement instead of innerHTML in extension.component.ts.\n2.\tValidate the extension against registered plugin IDs.\n3.\tEnforce a strict custom-element-name regex before mounting.","categories":["Libraries & packages"],"product":"org.yamcs:yamcs-core","vendor":"yamcs","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-09-28T12:47:44Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.yamcs:yamcs-core"},"range":">= 5.13.0, <= 5.13.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-09-28T12:47:44Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.yamcs:yamcs-core"},"range":"<= 5.12.7"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55566","source_modified_at":"2026-08-28T20:31:29.178Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"yamcs","vendor":"yamcs","versions":[{"version":"< 5.12.8","status":"affected"},{"version":">= 5.13.0, < 5.13.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-08-28T17:55:38.188149Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","purl":"pkg:maven/org.yamcs/yamcs-core"},"ranges":[{"events":[{"introduced":"5.13.0"},{"fixed":"5.13.2"}],"type":"ECOSYSTEM"}],"versions":["5.13.0","5.13.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-08-28T17:55:38.188149Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","purl":"pkg:maven/org.yamcs/yamcs-core"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.12.8"}],"type":"ECOSYSTEM"}],"versions":["0.29.3","0.30.0","3.0.0","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1","3.4.0","3.4.1","3.4.11","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.8","4.0.0","4.0.1","4.1.1","4.1.2","4.10.0","4.10.1","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.10.9","4.2.0","4.2.1","4.2.2","4.3.0","4.3.1","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7","4.7.1","4.7.3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-09-28T12:47:44Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.yamcs:yamcs-core"},"version":"5.13.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-09-28T12:47:44Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.yamcs:yamcs-core"},"version":"5.12.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-08-28T17:55:38.188149Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","purl":"pkg:maven/org.yamcs/yamcs-core"},"version":"5.13.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9272-wg2r-7xmx","source_modified_at":"2026-08-28T17:55:38.188149Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","purl":"pkg:maven/org.yamcs/yamcs-core"},"version":"5.12.8"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0038,"percentile":0.3082,"score_date":"2026-10-23"},"published_at":"2026-08-28T17:31:39.197Z","modified_at":"2026-09-28T12:47:44Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T12:47:44Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55566","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-08-28T20:31:29.178Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9272-wg2r-7xmx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-08-28T17:55:38.188149Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55566","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/yamcs/yamcs/commit/8e18e279d8ce761c21f4f67bbd06a1bff804d297","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/yamcs/yamcs/commit/ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-9272-wg2r-7xmx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-08-28T20:30:29.994741Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-28T12:47:44Z","content_hash":"38c90bb413ba70efcda4b1ff1dde770fbc8c2933dd1e1b24b7dad510340062ca"}}