CVE-2026-55566 yamcs CVE debrief

Who should care

Defenders responsible for Yamcs web applications, particularly those exposed to untrusted input, should assess their exposure and prioritize upgrading to fixed versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the exposure of their Yamcs web applications and plan for remediation. They should also review compensating controls for exposed systems and monitor for suspicious to un

Why it matters

CVE-2026-55566 is a medium-severity vulnerability in the Yamcs mission control framework that allows for JavaScript execution via crafted URL, potentially leading to data exposure and requiring defenders to verify exposure and upgrade to fixed versions.

• Potential for JavaScript execution in user context
• Possible data exposure within the Yamcs web application
• Need for verification of exposure and upgrade to fixed versions

Technical summary

The Yamcs mission control framework processes attacker-controlled data from the /ext URL route without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user, potentially allowing the attacker to read data available to the Yamcs web application and perform actions in the user context. This issue can be mitigated by verifying exposure of Yamcs web applications to untrusted input and upgrading to fixed versions, such as 5.12.8 or 5.13.2, which address the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Yamcs web applications to untrusted input and upgrading to fixed versions.

Recommended defensive actions

• Verify exposure of Yamcs web applications to untrusted input
• Upgrade to versions 5.12.8 or 5.13.2
• Monitor for suspicious activity on Yamcs web applications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, which requires verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.