A code injection vulnerability exists in Yamcs, a mission control framework, prior to versions 5.12.8 and 5.13.2. The flaw resides in LikeExpression.fillCode_getValueReturn in LikeExpression.java, where an unescaped LIKE pattern is inserted into Java source code compiled at runtime via SimpleCompiler.cook, bypassing the escapeJavaString sanitization. The vulnerability can be triggered through multiple API endpoints including executeSql, streamSql, readRows, events, and activity searches. Attackers with access to these endpoints (ReadTables, ReadEvents, or ReadActivities permissions) can inject arbitrary Java code that executes with the privileges of the Yamcs server process. This represents a serious remote code execution risk in mission-critical environments. The issue has been patched in Yamcs versions 5.12.8 and 5.13.2, with fixes available via two separate commits on GitHub.