GHSA-9272-wg2r-7xmx

Suggest an improvement
Source
https://github.com/advisories/GHSA-9272-wg2r-7xmx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9272-wg2r-7xmx/GHSA-9272-wg2r-7xmx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9272-wg2r-7xmx
Aliases
Published
2026-08-28T17:32:16Z
Modified
2026-08-28T17:56:00Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Yamcs has DOM XSS in Extension Routing
Details

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.

Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email.

image

Steps to Reproduce:

  1. Start a Yamcs instance.
  2. Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance):
http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject
  1. You will receive an alert with the number ‘1’ in it.

Recommendations:

  1. Use document.createElement instead of innerHTML in extension.component.ts.
  2. Validate the extension against registered plugin IDs.
  3. Enforce a strict custom-element-name regex before mounting.
Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-28T17:32:16Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.yamcs:yamcs-core

Package

Name
org.yamcs:yamcs-core
View open source insights on deps.dev
Purl
pkg:maven/org.yamcs/yamcs-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.13.2

Affected versions

5.*
5.13.0
5.13.1

Database specific

last_known_affected_version_range 
"<= 5.13.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9272-wg2r-7xmx/GHSA-9272-wg2r-7xmx.json"

Maven / org.yamcs:yamcs-core

Package

Name
org.yamcs:yamcs-core
View open source insights on deps.dev
Purl
pkg:maven/org.yamcs/yamcs-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.12.8

Affected versions

0.*
0.29.3
0.30.0
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.8
3.4.11
4.*
4.0.0
4.0.1
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.6.2
4.6.3
4.7
4.7.1
4.7.3
4.8.0
4.8.1
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
5.*
5.0.0
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.5
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
5.7.10
5.7.11
5.7.12
5.7.13
5.8.0
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.8.7
5.8.8
5.9.0
5.9.1
5.9.2
5.9.3
5.9.4
5.9.5
5.9.6
5.9.7
5.9.8
5.9.8.1
5.9.9
5.9.10
5.9.11
5.9.12
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.10.10
5.10.11
5.10.12
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.11.5
5.11.6
5.11.7
5.11.8
5.11.9
5.11.10
5.11.11
5.11.12
5.11.13
5.12.0
5.12.1
5.12.2
5.12.3
5.12.4
5.12.5
5.12.6
5.12.7

Database specific

last_known_affected_version_range 
"<= 5.12.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9272-wg2r-7xmx/GHSA-9272-wg2r-7xmx.json"