Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55673PowSyBl: Command Injection in LocalCommandExecutor-s

High 7.1

In plain English

A high-severity OS command injection in powsybl-core from powsybl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavencom.powsybl:powsybl-computation-local7.2.2GHSA-jqvf-j3ww-r8c7

Affected products (as reported)

VendorProductVersions
powsybl powsybl-core < 7.2.2

Weakness: CWE-78, CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

References