Command Injection Vulnerability in PowSyBl Core

PowSyBl Core, specifically the powsybl-computation-local package versions 7.2.1 and earlier, contains critical command injection vulnerabilities (CWE-78) and argument injection (CWE-88) flaws. The library constructs shell command strings using insecure concatenation methods before passing them to the underlying operating system shell (bash -c on Unix/Linux, cmd /c on Windows).

The vulnerability is exposed through public APIs in classes like UnixLocalCommandExecutor, WindowsLocalCommandExecutor, and LocalComputationManager, as well as several itools commands including action-simulator and security-analysis. Because the library does not properly sanitize input parameters or environment variables, an attacker providing input to these APIs can escape the intended command sequence and execute arbitrary shell instructions with the privileges of the JVM process. This poses a significant risk to downstream services, such as REST front-ends or multi-tenant grid analysis platforms that process external inputs.

Impact

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the JVM user. This includes full system access, unauthorized file operations (read/write/execute), process spawning, and data exfiltration. The impact is elevated for services that expose these computation parameters to untrusted users, enabling remote code execution without the attacker needing to interact with the PowSyBl codebase directly.

Recommendation

• Upgrade com.powsybl:powsybl-computation-local to version 7.2.2 or higher immediately to address CVE-2026-55673.
• If immediate patching is not feasible, implement strict input validation for all user-provided arguments in the application layer, forbidding shell metacharacters such as ';', '|', '&', '$', and others identified in the official advisory for Unix and Windows systems.
• Audit applications that integrate powsybl-computation-local to determine if they pass untrusted input to any of the vulnerable public methods, including LocalComputationManager.execute() or the itools command-line utilities.