TI-2026-40094 Aliases CVE-2026-55549 GHSA-rxpg-wjf8-qv9c

Yamcs: Reflected XSS in the URL of the Authorize Endpoint

MEDIUM 62CWE-79Published 2026-08-28 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01305 70th percentileScored 2026-11-07

Fix Fixed yamcs (yamcs): 5.9.4org.yamcs:yamcs-core (Maven): 5.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
yamcs	yamcs	before 5.9.4	5.9.4	Patch available	CNA
—	org.yamcs:yamcs-core (Maven)	before 5.9.4	5.9.4	Patch available	GHSA-rxpg-wjf8-qv9c

yamcs Vendoryamcs Affected before 5.9.4 Fixed in 5.9.4 Patch available CNA
org.yamcs:yamcs-core (Maven) Vendor— Affected before 5.9.4 Fixed in 5.9.4 Patch available GHSA-rxpg-wjf8-qv9c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:spaceapplications:yamcs::::::::	—	—	yamcs

cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:* Versions — — ·yamcs

Remediation

Fix · CNA yamcs (yamcs) Fixed in 5.9.4
Fix · GHSA-rxpg-wjf8-qv9c org.yamcs:yamcs-core (Maven) Fixed in 5.9.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-55549
2026-10-03 Alias added: GHSA-rxpg-wjf8-qv9c

References

Other 4

TI-2026-40103 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) CVSS 3.1CRITICAL 9.8
TI-2026-34240 Yamcs: Remote Code Execution via Mission Database algorithm override CVSS 3.1CRITICAL 9.8
TI-2026-32507 Yamcs: No Rate Limiting on Authentication Endpoint CVSS 3.1CRITICAL 9.8
TI-2026-40106 Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) CVSS 3.1CRITICAL 9.9
TI-2026-40057 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` CVSS 3.1CRITICAL 9.1
TI-2026-34277 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection CVSS 3.1CRITICAL 9.1

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences