CVE-2026-44632

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

• CWE-94

• https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011Patch
• https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992Patch
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7Release Notes
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0Release Notes
• https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6Exploit, Vendor Advisory
• https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6Exploit, Vendor Advisory

Published

Jul 16, 2026

Last Modified

Jul 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44621With NLnet Labs Unbound up to and including version 1.25.1, …5.9
• CVE-2026-44622Charging station authentication identifiers are publicly acc…6.9
• CVE-2026-44628An unauthenticated attacker can crash the worklist server wi…8.7
• CVE-2026-4463Heap buffer overflow in WebRTC in Google Chrome prior to 146…8.8
• CVE-2026-44630Improper validation of length fields in the Apache IoTDB RPC…7.5
• CVE-2026-44631Buffer Underwrite vulnerability in Apache HTTP Server on cra…9.8
• CVE-2026-44633Live Helper Chat is an open-source application that enables …8.1
• CVE-2026-44634SimpleBLE is a cross-platform library and bindings for Bluet…8.7
• CVE-2026-44635Kysely is a type-safe TypeScript SQL query builder. From 0.2…7.5
• CVE-2026-44636libsixel is a SIXEL encoder/decoder implementation derived f…7.8
• CVE-2026-44637libsixel is a SIXEL encoder/decoder implementation derived f…7.1
• CVE-2026-44638libsixel is a SIXEL encoder/decoder implementation derived f…2.5