CVE-2026-55673: PowSyBl Framework RCE Vulnerability

CVE-2026-55673 Overview

CVE-2026-55673 is a command injection vulnerability [CWE-78] in PowSyBl (Power System Blocks), an open-source framework for building power system oriented software. The flaw exists in UnixLocalCommandExecutor and WindowsLocalCommandExecutor, which concatenate command arguments and environment variables into strings interpreted by bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching these executors can break out of the intended command and run arbitrary shell commands as the JVM user. The issue affects PowSyBl versions prior to 7.2.2 and is fixed in 7.2.2.

Critical Impact
Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward untrusted contingency identifiers or computation parameters into affected APIs can expose this injection remotely.

Affected Products

PowSyBl powsybl-core versions prior to 7.2.2
itools paths: action-simulator with task-count, security-analysis with external, and dynamic-security-analysis
Applications invoking LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync

Discovery Timeline

2026-08-28 - CVE-2026-55673 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55673

Vulnerability Analysis

PowSyBl provides local command executor classes to run external computational tools such as AMPL models and load flow simulators. Both UnixLocalCommandExecutor and WindowsLocalCommandExecutor build shell command strings by concatenating user-supplied argument values and environment variable values. The resulting string is then passed to bash -c on Unix systems or cmd /c on Windows. Because arguments and environment values are not properly quoted or escaped, shell metacharacters within attacker-controlled inputs are interpreted by the shell rather than treated as literal data.

An attacker who can influence contingency identifiers, computation parameters, or environment variables reaching UnixLocalCommandExecutor.execute or WindowsLocalCommandExecutor.execute can inject shell operators such as ;, &&, |, backticks, or $(...) to execute arbitrary commands under the JVM's user context.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. Command construction relies on string concatenation and shell interpretation, rather than argument-vector process execution (ProcessBuilder with a List<String>) that would bypass shell parsing entirely.

Attack Vector

Exploitation is remote when PowSyBl is embedded in web services, REST APIs, or multi-tenant grid-analysis platforms that accept computation parameters or contingency identifiers from clients. Any HTTP endpoint, message queue consumer, or job orchestrator that forwards user input into the affected APIs is a viable injection point. The attacker needs privileges sufficient to submit a computation request; no user interaction is required. See the GitHub Security Advisory GHSA-jqvf-j3ww-r8c7 for technical details.

Detection Methods for CVE-2026-55673

Indicators of Compromise

Unexpected child processes spawned by the JVM running PowSyBl, particularly bash -c or cmd /c invocations with unusual argument content
Shell metacharacters (;, &&, |, `, $() present in contingency identifiers, computation parameters, or environment variables in application logs
Outbound network connections originating from PowSyBl worker processes to unfamiliar hosts
File system writes or reads outside the expected PowSyBl working directories

Detection Strategies

Inventory Java applications for powsybl-core dependencies below version 7.2.2 using software composition analysis
Instrument application logs to record raw inputs passed to LocalComputationManager.execute, ActionSimulatorTool.run, and AmplModelRunner.run
Correlate JVM process ancestry with shell invocations to identify anomalous command execution chains

Monitoring Recommendations

Monitor process creation events where the parent is the Java runtime and the child is bash, sh, or cmd.exe with -c or /c flags
Alert on shell metacharacters appearing in HTTP request parameters routed to PowSyBl itools endpoints such as action-simulator, security-analysis, and dynamic-security-analysis
Track outbound connections and file modifications from PowSyBl service accounts against a baseline of expected behavior

How to Mitigate CVE-2026-55673

Immediate Actions Required

Upgrade powsybl-core to version 7.2.2 or later across all deployments and downstream tools
Audit all callers of UnixLocalCommandExecutor, WindowsLocalCommandExecutor, LocalComputationManager, ParallelLoadFlowActionSimulator, ActionSimulatorTool, and AmplModelRunner for untrusted input
Restrict network exposure of REST front ends and CLI wrappers that forward external input into PowSyBl computation APIs

Patch Information

The vulnerability is fixed in PowSyBl powsybl-corev7.2.2. The fix is delivered via Pull Request #3973 with commits 17461264 and 7aa28d8c, which replace shell-based command construction with argument-vector execution.

Workarounds

Validate and reject contingency identifiers and computation parameters containing shell metacharacters before invoking PowSyBl APIs
Run PowSyBl worker JVMs as a low-privilege user in an isolated environment or container with restricted filesystem and network access
Strip or reject client-controlled environment variables at the application boundary until the upgrade is applied

bash

# Update Maven dependency to patched version
# In pom.xml:
# <dependency>
#   <groupId>com.powsybl</groupId>
#   <artifactId>powsybl-core</artifactId>
#   <version>7.2.2</version>
# </dependency>
mvn versions:set-property -Dproperty=powsybl.version -DnewVersion=7.2.2
mvn clean verify