[0x73746F66]

Rewrites GCVE-110-VULN-PYPI-2026-000868 (yamcs-fops), disputed in #12.

The record described the shell's exec() as the weakness. That shell is a documented feature: eval and set_variable need fops.Shell and control of the execution, and the README says what the privilege grants. The real issue is whose Yamcs privileges that code acts with.

Evidence

• v0.1.0 / v0.1.1: Executions.launch gives the worker a Yamcs token for the user who started the execution, or for the service user on a timeline run (Executions.java#L322, #L338). Execution.takeControl only changes the controller and keeps that token. Sub-procedures also start as the original user (startCall(parent, r, user)).
• Any execution without a controller can be taken over: one that was released, a timeline run, or one the plugin paused after its controller stopped polling (controller_lost). Through the shell, a user with fops.Control + fops.Shell then acts with the starter's (or service user's) privileges. Answering a command prompt, by contrast, checks the acting user's own Command privilege (FopsHandler.java#L237).
• Fix: v0.2.0 (b804d7a, "Controller takeover runs as the new controller"). On takeover the worker gets a token for the new controller, the earlier user's tokens are revoked, and sub-procedures start as the user the parent runs as. The commit says: "So fops.Shell can no longer act with someone else's privileges."
• Published versions: PyPI yamcs-fops 0.1.0, 0.1.1, 0.2.0, 0.2.1. Maven Central com.jaops.yamcs:yamcs-fops 0.1.0, 0.2.0, 0.2.1 (0.1.1 was never published there). Both are released together at one version.
• Still by design in 0.2.x, and documented in the README: the shell has the OS access of the worker's account. That is the Yamcs account for workers Yamcs starts itself. The record states this but does not count it as the flaw.

Change

	Before	After
Title	Dynamic code execution in PyPI package yamcs-fops	yamcs-fops runs a taken-over procedure, its shell included, with the Yamcs privileges of the user who started it
CWE	CWE-94	CWE-269 Improper Privilege Management
CVSS 3.1	4.2 AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L	6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected	PyPI 0.1.0, 0.1.1 (no fix)	PyPI yamcs-fops and Maven com.jaops.yamcs:yamcs-fops: 0.1.0 up to 0.2.0, fixed 0.2.0, default unaffected

CVSS rationale:

• AV:N: the shell is reached through the plugin's HTTP API.
• PR:H: needs fops.Control + fops.Shell.
• AC:H: needs an uncontrolled execution started by a user with more privileges, or a timeline run.
• C/I/A:H: the attacker gets the starter's or service user's Yamcs rights, which can include commanding.

Other changes:

• Remediation (configurations, solutions, workarounds) in all three formats.
• Maven affected code (Execution.takeControl, Executions.launch).
• Dropped detection.matched_lines, because the exec() line is the feature, not the flaw.
• References: Dispute: GCVE-110-VULN-PYPI-2026-000868 - It's a feature not a bug #12 as disputed, the fix commit, the 0.2.0 releases. CVE 5 also gets the disputed tag.
• modified / dateUpdated / index/manifest.json updated.

The Vulnetix record validates against schemas/vulnetix-advisory-1.3.0.schema.json. The OSV and CVE 5 files validate against the upstream OSV and CVE 5.1 schemas (with the id patterns aside).

Closes #12