CVE-2026-55566: Yamcs Mission Control Framework XSS Vulnerability

CVE-2026-55566 Overview

CVE-2026-55566 is a reflected Cross-Site Scripting (XSS) vulnerability in Yamcs, an open-source mission control framework. The flaw exists in the /ext URL route handling within the Yamcs web application. Prior to versions 5.12.8 and 5.13.2, the application processes attacker-controlled data from the URL and renders it through innerHTML without validating registered plugin identifiers. A crafted URL executes JavaScript in the victim's browser when opened, allowing the script to read data available to the Yamcs web application and perform actions in the user's context. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A crafted /ext URL executes attacker JavaScript in the authenticated user's browser session, exposing mission control data and enabling actions in the user's context.

Affected Products

Yamcs versions prior to 5.12.8 (5.12.x branch)
Yamcs versions prior to 5.13.2 (5.13.x branch)
Affected files: extension.matcher.ts, extension.component.ts, and app.component.ts in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/

Discovery Timeline

2026-08-28 - CVE-2026-55566 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55566

Vulnerability Analysis

The Yamcs web application supports extension plugins via the /ext route. Route resolution logic in extension.matcher.ts accepts a URL segment representing a plugin identifier and passes it to extension.component.ts for rendering. The component previously inserted this identifier into the DOM using innerHTML without validating that the value corresponded to a registered plugin ID.

Because the identifier is derived from the URL path and rendered as HTML, an attacker who crafts a link containing markup or script payloads triggers client-side script execution when a victim opens the URL. The script runs with the origin and session context of the Yamcs web application, granting access to authenticated APIs and any data visible to the user.

User interaction is required, so exploitation depends on phishing or link-sharing to authenticated Yamcs operators. Successful exploitation impacts confidentiality of session data and allows the attacker to invoke Yamcs actions as the victim.

Root Cause

The root cause is missing input validation combined with unsafe DOM sink usage. The extension route accepted arbitrary strings as plugin identifiers and rendered them via innerHTML, an unsafe sink for untrusted data. There was no allowlist check against registered plugin IDs before rendering.

Attack Vector

The attack requires the victim to click a specially crafted URL pointing at the Yamcs /ext route. No prior authentication of the attacker is required, but the victim must have an active Yamcs session for the payload to access sensitive data or perform actions.

typescript

// Security patch: validation regex added to extension.component.ts
 } from '@angular/core';
 import { ExtensionService, WebappSdkModule } from '@yamcs/webapp-sdk';

+const VALID_EXTENSION_NAME_REGEX = /^[a-z][a-z0-9_]*-[a-z0-9_-]*$/;
+
 @Component({
   templateUrl: './extension.component.html',
   changeDetection: ChangeDetectionStrategy.OnPush,

Source: GitHub Commit 8e18e27 and GitHub Commit ecf34a4. The patch introduces VALID_EXTENSION_NAME_REGEX to restrict extension identifiers to a strict character set before use.

Detection Methods for CVE-2026-55566

Indicators of Compromise

Web server or reverse-proxy access logs containing requests to /ext/ paths with HTML entities, angle brackets, <script> fragments, or URL-encoded payloads such as %3Cscript
Requests to /ext/ with plugin identifiers that do not match any registered Yamcs extension
Referrer headers pointing to external domains preceding /ext requests, indicating phishing-driven click-through

Detection Strategies

Enforce a Content Security Policy (CSP) that reports script violations, and monitor CSP report endpoints for blocked inline script execution originating from the Yamcs application
Deploy a Web Application Firewall (WAF) signature to flag requests to /ext/* containing markup metacharacters or JavaScript keywords in the path
Correlate outbound authenticated Yamcs API activity with recent /ext requests to identify sessions that may be executing attacker-controlled scripts

Monitoring Recommendations

Ingest Yamcs web server access logs and browser CSP reports into a centralized SIEM for query and alerting
Alert on anomalous plugin-identifier segments in /ext requests that fail the ^[a-z][a-z0-9_]*-[a-z0-9_-]*$ pattern applied by the patch
Review user reports of unexpected browser behavior or session anomalies when accessing Yamcs links from external sources

How to Mitigate CVE-2026-55566

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 or 5.13.2 as published in the yamcs-5.12.8 release and yamcs-5.13.2 release
Review the GHSA-9272-wg2r-7xmx security advisory for maintainer guidance
Instruct operators to avoid clicking Yamcs links received from untrusted sources until patching is complete

Patch Information

The fix is delivered in commits 8e18e27 and ecf34a4. The patch adds VALID_EXTENSION_NAME_REGEX to constrain extension identifiers and validates them against registered plugin IDs before DOM rendering. Upgrade to 5.12.8 (5.12.x branch) or 5.13.2 (5.13.x branch).

Workarounds

Place the Yamcs web interface behind a reverse proxy that rejects /ext/* request paths containing characters outside [a-z0-9_-]
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources for the Yamcs origin
Restrict Yamcs web application access to trusted networks or VPN-only paths to reduce the phishing exposure surface until patches are applied

bash

# Example nginx rule to block malformed /ext paths until patched
location ~* ^/ext/ {
    if ($request_uri ~* "[<>\"'%]|script|onerror|onload") {
        return 400;
    }
    proxy_pass http://yamcs_backend;
}