CVE-2026-55566: XSS
Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email. <img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />
Steps to Reproduce: 1. Start a Yamcs instance. 2. Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance): http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject 3. You will receive an alert with the number ‘1’ in it.
Recommendations: 1. Use document.createElement instead of innerHTML in extension.component.ts. 2. Validate the extension against registered plugin IDs. 3. Enforce a strict custom-element-name regex before mounting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.12.8 - Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.13.2
Event History
Frequently Asked Questions
Does exploitation require an authenticated Yamcs account or privileged access?
No. The issue is unauthenticated and can be triggered remotely, but it requires a user to visit an attacker-crafted /ext URL, such as through a phishing message.
Who is exposed to this issue?
Users whose browsers can access a vulnerable Yamcs instance and are persuaded to open a crafted /ext URL are exposed. The reported impact is arbitrary JavaScript execution in that user's browser.
What can be done if a fix cannot be applied immediately?
Avoid mounting unvalidated extension names through innerHTML. Use document.createElement, validate extensions against registered plugin IDs, and enforce a strict custom-element-name regular expression before mounting.
What is the expected impact beyond the affected user's browser session?
The supplied assessment indicates low confidentiality impact and no integrity or availability impact. The reported behavior is limited to executing attacker-controlled JavaScript in the browser of a user who follows the crafted URL.