{"id":"CVE-2026-55673","summary":"PowSyBl: Command Injection in LocalCommandExecutor-s","details":"PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.","aliases":["GHSA-jqvf-j3ww-r8c7"],"modified":"2026-08-30T08:17:24.308453Z","published":"2026-08-28T18:36:53.110Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55673.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-78","CWE-88"]},"references":[{"type":"WEB","url":"https://github.com/powsybl/powsybl-core/releases/tag/v7.2.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55673.json"},{"type":"ADVISORY","url":"https://github.com/powsybl/powsybl-core/security/advisories/GHSA-jqvf-j3ww-r8c7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55673"},{"type":"FIX","url":"https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db"},{"type":"FIX","url":"https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a"},{"type":"FIX","url":"https://github.com/powsybl/powsybl-core/pull/3973"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/powsybl/powsybl-core","events":[{"introduced":"0"},{"fixed":"17461264d1d18f9bba43bb7855f251e9fa55a4db"},{"fixed":"7aa28d8c2492bbcd061585cb498acce72d5ed79a"},{"fixed":"efc49f0bb3c624601981855717e38bb0364856ad"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"7.2.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v7.2.1","v7.3.0-RC1","v7.2.0","v7.2.0-RC1","v7.1.0-RC1","v7.0.0-RC1","v6.8.0-RC1","v6.7.0-RC1","v6.6.0-RC1","v6.5.0-RC1","v6.4.0-RC1","v6.3.0","v6.2.0-RC1","v6.1.0","v6.0.0-RC1","v5.3.0","v5.2.0-RC1","v5.1.0-RC1","v5.0.0-RC1","v4.10.0-RC1","v4.9.0-RC1","v4.8.0-RC1","v4.7.0-RC1","v4.6.0-RC1","v4.5.0-RC1","v4.4.0-RC1","v4.2.0-RC1","v4.1.0-RC1","v4.0.0-RC1","v3.8.0-RC1","v3.7.0-RC1","v3.5.0-RC1","v3.3.0-RC1","v3.0.0","v2.6.0","v2.5.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55673.json","vanir_signatures_modified":"2026-08-30T08:17:24Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java","function":"execute"},"deprecated":false,"digest":{"function_hash":"6619697322407012357895561717904909515","length":1198},"id":"CVE-2026-55673-12cbaac1"},{"digest":{"line_hashes":["212726118260634117473826602932741398854","284660578147462812275832179466384671307","122891244981415827964598941571676133106","72495469479674752891784557052848358112","77769237583638215282609983706202202661","70740936913639786364683136457514872219","122720492934460559416883026172713704551","210615598372121088114226284125049899520","208688402170523109286372540855535255107","103056524902589624970251152811013298865"],"threshold":0.9},"id":"CVE-2026-55673-13912e83","signature_type":"Line","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"},"deprecated":false},{"digest":{"function_hash":"120617381547184163959973058077791878480","length":989},"id":"CVE-2026-55673-303b000c","signature_type":"Function","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java","function":"execute"},"deprecated":false},{"source":"https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a","target":{"function":"execute","file":"computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"},"deprecated":false,"digest":{"function_hash":"6619697322407012357895561717904909515","length":1198},"id":"CVE-2026-55673-71200ba5","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["128988357557255420261759310250235048582","810391743413195549282492810927538439","116951408524398562095943258244393681180","162034835452069607152531645356646654637","315557459238260418685684101763458461686","88982044153717445034198458361076878086","324524450752501847464236012490041594725","328900974012425646131801515507808653153","77769237583638215282609983706202202661","70740936913639786364683136457514872219","235747014825004715340607654629434098768","33616745200356312762787558644925132599","208688402170523109286372540855535255107","103056524902589624970251152811013298865"],"threshold":0.9},"id":"CVE-2026-55673-80e3dee5","signature_type":"Line","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["212726118260634117473826602932741398854","284660578147462812275832179466384671307","122891244981415827964598941571676133106","72495469479674752891784557052848358112","77769237583638215282609983706202202661","70740936913639786364683136457514872219","122720492934460559416883026172713704551","210615598372121088114226284125049899520","208688402170523109286372540855535255107","103056524902589624970251152811013298865"]},"id":"CVE-2026-55673-a93cbb72","signature_type":"Line","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"}},{"digest":{"function_hash":"120617381547184163959973058077791878480","length":989},"id":"CVE-2026-55673-c8bd3434","signature_type":"Function","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a","target":{"function":"execute","file":"computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"},"deprecated":false},{"id":"CVE-2026-55673-f0c4b2cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a","target":{"file":"computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"},"deprecated":false,"digest":{"line_hashes":["128988357557255420261759310250235048582","810391743413195549282492810927538439","116951408524398562095943258244393681180","162034835452069607152531645356646654637","315557459238260418685684101763458461686","88982044153717445034198458361076878086","324524450752501847464236012490041594725","328900974012425646131801515507808653153","77769237583638215282609983706202202661","70740936913639786364683136457514872219","235747014825004715340607654629434098768","33616745200356312762787558644925132599","208688402170523109286372540855535255107","103056524902589624970251152811013298865"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}