Yamcs has DOM XSS in Extension Routing
Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.
<img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />Steps to Reproduce:
- Start a Yamcs instance.
- Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject- You will receive an alert with the number ‘1’ in it.
Recommendations:
- Use document.createElement instead of innerHTML in extension.component.ts.
- Validate the extension against registered plugin IDs.
- Enforce a strict custom-element-name regex before mounting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.yamcs:yamcs-core | >= 5.13.0, < 5.13.2, < 5.12.8 | 5.13.2, 5.12.8 |
References
- https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx
- https://github.com/yamcs/yamcs/commit/8e18e279d8ce761c21f4f67bbd06a1bff804d297
- https://github.com/yamcs/yamcs/commit/ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa
- https://github.com/yamcs/yamcs
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-79- Platform
- Java / Kotlin (Maven)
- Package
org.yamcs:yamcs-core- Disclosed
- 28.08.2026
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9272-wg2r-7xmx - CC BY 4.0
Vulnerability history: org.yamcs:yamcs-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 05.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 2
- Medium 8
Disclosures per year
- 2026: 16
-
Yamcs has DOM XSS in Extension Routing this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.