Lapse of Sanity AI Safety & Security Research by Marnick Vandecauter

Published CVEs

Vulnerabilities I reported and that have been fixed and published by the vendor. Every entry links to the vendor advisory, which carries the full technical write-up.

  1. CVE-2026-55565 Critical 9.9

    Yamcs: remote code execution via an unescaped StreamSQL LIKE pattern compiled by Janino.

    Product
    Yamcs (mission control) org.yamcs:yamcs-core
    Class
    CWE-94, code injection
    CVSS 3.1
    AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Affected
    5.12.7 and earlier, and 5.13.0 to 5.13.1
    Fixed in
    5.12.8, 5.13.2
    Published
    2026-08-28
  2. CVE-2026-77602 Critical 9.9

    OpenC3 COSMOS: remote code execution via the user-writable config overlay (table definitions, command and telemetry definitions, script suites).

    Product
    OpenC3 COSMOS (ground system) openc3
    Class
    CWE-94, code injection
    CVSS 3.1
    AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Affected
    5.1.0 to 7.2.1
    Fixed in
    7.3.0
    Published
    2026-09-03
  3. CVE-2026-77601 High 8.8

    OpenC3 COSMOS: OS command injection via the pypi_url setting.

    Product
    OpenC3 COSMOS (ground system) openc3
    Class
    CWE-78, OS command injection
    CVSS 3.1
    AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Affected
    5.12.0 to 7.2.1
    Fixed in
    7.3.0
    Published
    2026-09-03
  4. GHSA-24cm-2vgv-fjj6 High 8.5

    Yamcs: account takeover via an unvalidated redirect_uri that leaks the login authorization code.

    Product
    Yamcs (mission control) org.yamcs:yamcs-core
    Class
    CWE-287 and CWE-601, improper authentication through an open redirect
    CVSS 4.0
    AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    Affected
    5.13.6 and earlier
    Fixed in
    5.13.7
    CVE
    requested, not yet assigned
    Published
    2026-10-17
  5. GHSA-p2wh-wwm7-qh9x Moderate 6.5

    Yamcs: ReadTables privilege bypass via unvalidated StreamSQL in TableApi.readRows (cols and query).

    Product
    Yamcs (mission control) org.yamcs:yamcs-core
    Class
    CWE-943, improper neutralisation of special elements in a data query
    CVSS 3.1
    AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    Affected
    earlier than 5.13.6
    Fixed in
    5.13.6
    CVE
    requested, not yet assigned
    Published
    2026-10-01

    Scored Moderate rather than higher because the remediation of another vulnerability, which shipped first, had already removed part of this one’s impact.

Reported under coordinated disclosure. Questions or corrections: email me.