Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yamcs:yamcs-core | maven | >= 5.13.0, <= 5.13.1 | 5.13.2 |
| org.yamcs:yamcs-core | maven | <= 5.12.7 | 5.12.8 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55566, describes a DOM XSS issue in Yamcs related to the /ext URL route, where attacker-controlled data was processed without proper validation before DOM rendering via innerHTML. The provided commit information directly addresses this vulnerability. Both commits, 8e18e279d8ce761c21f4f67bbd06a1bff804d297 and ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa, modify the file yamcs-web/src/main/webapp/projects/webapp/src/app/appbase/extension/extension.component.ts. The core change in these commits is within the loadExtension private method of the ExtensionComponent class. Prior to the fix, this method contained the line holder.innerHTML = <${extension}></${extension}>;. This line directly inserted the extension variable, derived from user input, into the DOM as HTML. This is a classic DOM XSS vector. The fix introduces a regular expression VALID_EXTENSION_NAME_REGEX to validate the extension string and, crucially, replaces the innerHTML assignment with document.createElement(extension) followed by holder.appendChild(extensionEl). This change prevents the direct interpretation of attacker-controlled strings as HTML, thereby mitigating the XSS vulnerability. Therefore, ExtensionComponent.loadExtension is the precise vulnerable function that would appear in a runtime profiler during exploitation.
ExtensionComponent.loadExtensionyamcs-web/src/main/webapp/projects/webapp/src/app/appbase/extension/extension.component.ts