All vulnerabilities
CVE-2026-55566GHSA-9272-wg2r-7xmx

org.yamcs:yamcs-core: Yamcs has DOM XSS in Extension Routing

yamcs org.yamcs:yamcs-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Aug 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.13.2Also 5.12.8GitHub
Published28 Aug 2026Updated 28 Sep 2026CVE List

What fixes it

  • 5.13.2org.yamcs:yamcs-core, mavenGitHub<dependency><groupId>org.yamcs</groupId><artifactId>yamcs-core</artifactId><version>5.13.2</version></dependency>
  • 5.12.8org.yamcs:yamcs-core, mavenGitHub<dependency><groupId>org.yamcs</groupId><artifactId>yamcs-core</artifactId><version>5.12.8</version></dependency>
  • 5.13.2org.yamcs:yamcs-core, MavenOSV<dependency><groupId>org.yamcs</groupId><artifactId>yamcs-core</artifactId><version>5.13.2</version></dependency>
  • 5.12.8org.yamcs:yamcs-core, MavenOSV<dependency><groupId>org.yamcs</groupId><artifactId>yamcs-core</artifactId><version>5.12.8</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.

Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.

<img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />

Steps to Reproduce:

  1. Start a Yamcs instance.
  2. Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject
  1. You will receive an alert with the number ‘1’ in it.

Recommendations:

  1. Use document.createElement instead of innerHTML in extension.component.ts.
  2. Validate the extension against registered plugin IDs.
  3. Enforce a strict custom-element-name regex before mounting.

Text from GitHub Advisory Database

Affected versions 58

  • org.yamcs:yamcs-core, maven>= 5.13.0, <= 5.13.1GitHub
  • org.yamcs:yamcs-core, maven<= 5.12.7GitHub
  • yamcsaffected: < 5.12.8CVE List
  • yamcsaffected: >= 5.13.0, < 5.13.2CVE List
  • org.yamcs:yamcs-core, Mavenfrom 5.13.0, fixed in 5.13.2OSV
  • org.yamcs:yamcs-core, Maven5.13.0OSV
  • org.yamcs:yamcs-core, Maven5.13.1OSV
  • org.yamcs:yamcs-core, Mavenfrom first release, fixed in 5.12.8OSV
  • org.yamcs:yamcs-core, Maven0.29.3OSV
  • org.yamcs:yamcs-core, Maven0.30.0OSV
  • org.yamcs:yamcs-core, Maven3.0.0OSV
  • org.yamcs:yamcs-core, Maven3.1.0OSV
  • org.yamcs:yamcs-core, Maven3.1.1OSV
  • org.yamcs:yamcs-core, Maven3.1.2OSV
  • org.yamcs:yamcs-core, Maven3.2.0OSV
  • org.yamcs:yamcs-core, Maven3.2.1OSV
  • org.yamcs:yamcs-core, Maven3.2.2OSV
  • org.yamcs:yamcs-core, Maven3.3.0OSV
  • org.yamcs:yamcs-core, Maven3.3.1OSV
  • org.yamcs:yamcs-core, Maven3.4.0OSV
  • org.yamcs:yamcs-core, Maven3.4.1OSV
  • org.yamcs:yamcs-core, Maven3.4.11OSV
  • org.yamcs:yamcs-core, Maven3.4.2OSV
  • org.yamcs:yamcs-core, Maven3.4.3OSV
  • org.yamcs:yamcs-core, Maven3.4.4OSV
  • org.yamcs:yamcs-core, Maven3.4.5OSV
  • org.yamcs:yamcs-core, Maven3.4.6OSV
  • org.yamcs:yamcs-core, Maven3.4.8OSV
  • org.yamcs:yamcs-core, Maven4.0.0OSV
  • org.yamcs:yamcs-core, Maven4.0.1OSV
  • org.yamcs:yamcs-core, Maven4.1.1OSV
  • org.yamcs:yamcs-core, Maven4.1.2OSV
  • org.yamcs:yamcs-core, Maven4.10.0OSV
  • org.yamcs:yamcs-core, Maven4.10.1OSV
  • org.yamcs:yamcs-core, Maven4.10.2OSV
  • org.yamcs:yamcs-core, Maven4.10.3OSV
  • org.yamcs:yamcs-core, Maven4.10.4OSV
  • org.yamcs:yamcs-core, Maven4.10.5OSV
  • org.yamcs:yamcs-core, Maven4.10.6OSV
  • org.yamcs:yamcs-core, Maven4.10.7OSV
  • org.yamcs:yamcs-core, Maven4.10.8OSV
  • org.yamcs:yamcs-core, Maven4.10.9OSV
  • org.yamcs:yamcs-core, Maven4.2.0OSV
  • org.yamcs:yamcs-core, Maven4.2.1OSV
  • org.yamcs:yamcs-core, Maven4.2.2OSV
  • org.yamcs:yamcs-core, Maven4.3.0OSV
  • org.yamcs:yamcs-core, Maven4.3.1OSV
  • org.yamcs:yamcs-core, Maven4.4.0OSV
  • org.yamcs:yamcs-core, Maven4.4.1OSV
  • org.yamcs:yamcs-core, Maven4.4.2OSV
  • org.yamcs:yamcs-core, Maven4.5.0OSV
  • org.yamcs:yamcs-core, Maven4.6.0OSV
  • org.yamcs:yamcs-core, Maven4.6.1OSV
  • org.yamcs:yamcs-core, Maven4.6.2OSV
  • org.yamcs:yamcs-core, Maven4.6.3OSV
  • org.yamcs:yamcs-core, Maven4.7OSV
  • org.yamcs:yamcs-core, Maven4.7.1OSV
  • org.yamcs:yamcs-core, Maven4.7.3OSV

References 6