CVE-2026-55673

Received Received - Intake

Command Injection in PowSyBl Framework

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55673

EUVD

EUVD-2026-67863

Affected Vendors & Products

Vendor	Product	Version / Range
powsybl	powsybl-core	to 7.2.1 (inc)
powsybl	powsybl-core	7.2.2
com.powsybl	powsybl-computation-local	to 7.2.1 (inc)
com.powsybl	powsybl-computation-local	7.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-55673 is a command injection vulnerability in the PowSyBl framework's LocalCommandExecutor components. It allows attackers to execute arbitrary shell commands as the JVM user by exploiting improper escaping of command arguments and environment variables. The flaw affects UnixLocalCommandExecutor, WindowsLocalCommandExecutor, and related APIs in versions up to 7.2.1.

Detection Guidance

To detect this vulnerability, check if your system runs affected versions of powsybl-core (up to 7.2.1). Inspect logs for unusual command execution patterns or shell metacharacters in inputs passed to LocalCommandExecutor methods. Use network monitoring tools to detect unexpected outbound connections from JVM processes.

Impact Analysis

This vulnerability can lead to full system compromise, including file operations, data exfiltration, process spawning, or denial of service. Attackers can inject malicious commands through public APIs or exposed parameters in services using affected components like action-simulator or security-analysis.

Mitigation Strategies

Immediately update to powsybl-core version 7.2.2 or later. If patching is not possible, implement strict input validation to block dangerous characters like $(...), backticks, semicolons, or newlines in command arguments and environment variables. Restrict user permissions for JVM processes to limit potential damage from exploitation.

Hi! I’m here to help you understand CVE-2026-55673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70