CVE-2026-55565: Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The LIKE operator inserts the user-supplied pattern into the generated Java unescaped, inside a "..." literal, so a pattern containing " breaks out and injects arbitrary Java (e.g. a static{} block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.

The pattern is embedded raw whether it comes from a SQL string literal or a bound ? argument, so the sink is reachable from any endpoint that builds a LIKE from user input, at routine read-only privileges, not just executeSql:

• POST /api/archive/{instance}:executeSql and :streamSql (privilege ControlArchiving)
• POST /api/archive/{instance}/tables/{table}:readRows via the query field (privilege ReadTables)
• GET /api/archive/{instance}/events?q= and the event export/stream variants (privilege ReadEvents)
• listActivities q (privilege ReadActivities)

The Events page search box feeds q directly.

Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of ChangeMissionDatabase and is not affected by the overrideAlgorithmsEnabled gate.