EUVD-2026-67845
GHSA-9272-wg2r-7xmx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery with no auth (PR:N), but victim click required (UI:R); impact limited to browser-context confidentiality (C:L) with no server-side integrity or availability effect.
Primary rating from Vendor (https://github.com/yamcs/yamcs).
CVSS VectorVendor: https://github.com/yamcs/yamcs
Lifecycle Timeline
2Blast Radius
ecosystem impact- 7 maven packages depend on org.yamcs:yamcs-core (7 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.13.0.
DescriptionCVE.org
Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.
<img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />
Steps to Reproduce:
- Start a Yamcs instance.
- Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject- You will receive an alert with the number ‘1’ in it.
Recommendations:
- Use document.createElement instead of innerHTML in extension.component.ts.
- Validate the extension against registered plugin IDs.
- Enforce a strict custom-element-name regex before mounting.
AnalysisAI
DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required and no special server-side configuration is needed - the /ext endpoint is part of the default Yamcs web application and processes URL path segments without login. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) reflects the mandatory user-interaction step (UI:R) - the victim must navigate to a crafted URL - which is the primary real-world friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade org.yamcs:yamcs-core to version 5.12.8 (for 5.12.x deployments) or 5.13.2 (for 5.13.x deployments), as documented in the vendor release tags at https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 and https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2 and detailed in GHSA-9272-wg2r-7xmx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today