CVE-2026-55673

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55673
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55673.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55673
Aliases
Published
2026-08-28T18:36:53.110Z
Modified
2026-08-30T08:17:24.308453Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PowSyBl: Command Injection in LocalCommandExecutor-s
Details

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55673.json",
    "cwe_ids": [
        "CWE-78",
        "CWE-88"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/powsybl/powsybl-core

Affected ranges

Type
GIT
Repo
https://github.com/powsybl/powsybl-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
17461264d1d18f9bba43bb7855f251e9fa55a4db
Fixed
7aa28d8c2492bbcd061585cb498acce72d5ed79a
Fixed
efc49f0bb3c624601981855717e38bb0364856ad
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.2.2"
        }
    ]
}

Affected versions

v1.*
v1.1.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v3.*
v3.0.0
v3.3.0-RC1
v3.5.0-RC1
v3.7.0-RC1
v3.8.0-RC1
v4.*
v4.0.0-RC1
v4.1.0-RC1
v4.10.0-RC1
v4.2.0-RC1
v4.4.0-RC1
v4.5.0-RC1
v4.6.0-RC1
v4.7.0-RC1
v4.8.0-RC1
v4.9.0-RC1
v5.*
v5.0.0-RC1
v5.1.0-RC1
v5.2.0-RC1
v5.3.0
v6.*
v6.0.0-RC1
v6.1.0
v6.2.0-RC1
v6.3.0
v6.4.0-RC1
v6.5.0-RC1
v6.6.0-RC1
v6.7.0-RC1
v6.8.0-RC1
v7.*
v7.0.0-RC1
v7.1.0-RC1
v7.2.0
v7.2.0-RC1
v7.2.1
v7.3.0-RC1

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-55673-12cbaac1",
        "target": {
            "function": "execute",
            "file": "computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "6619697322407012357895561717904909515",
            "length": 1198.0
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55673-13912e83",
        "target": {
            "file": "computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "212726118260634117473826602932741398854",
                "284660578147462812275832179466384671307",
                "122891244981415827964598941571676133106",
                "72495469479674752891784557052848358112",
                "77769237583638215282609983706202202661",
                "70740936913639786364683136457514872219",
                "122720492934460559416883026172713704551",
                "210615598372121088114226284125049899520",
                "208688402170523109286372540855535255107",
                "103056524902589624970251152811013298865"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55673-303b000c",
        "target": {
            "function": "execute",
            "file": "computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "120617381547184163959973058077791878480",
            "length": 989.0
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55673-71200ba5",
        "target": {
            "function": "execute",
            "file": "computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "6619697322407012357895561717904909515",
            "length": 1198.0
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55673-80e3dee5",
        "target": {
            "file": "computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128988357557255420261759310250235048582",
                "810391743413195549282492810927538439",
                "116951408524398562095943258244393681180",
                "162034835452069607152531645356646654637",
                "315557459238260418685684101763458461686",
                "88982044153717445034198458361076878086",
                "324524450752501847464236012490041594725",
                "328900974012425646131801515507808653153",
                "77769237583638215282609983706202202661",
                "70740936913639786364683136457514872219",
                "235747014825004715340607654629434098768",
                "33616745200356312762787558644925132599",
                "208688402170523109286372540855535255107",
                "103056524902589624970251152811013298865"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55673-a93cbb72",
        "target": {
            "file": "computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "212726118260634117473826602932741398854",
                "284660578147462812275832179466384671307",
                "122891244981415827964598941571676133106",
                "72495469479674752891784557052848358112",
                "77769237583638215282609983706202202661",
                "70740936913639786364683136457514872219",
                "122720492934460559416883026172713704551",
                "210615598372121088114226284125049899520",
                "208688402170523109286372540855535255107",
                "103056524902589624970251152811013298865"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/17461264d1d18f9bba43bb7855f251e9fa55a4db",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55673-c8bd3434",
        "target": {
            "function": "execute",
            "file": "computation-local/src/main/java/com/powsybl/computation/local/UnixLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "120617381547184163959973058077791878480",
            "length": 989.0
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55673-f0c4b2cf",
        "target": {
            "file": "computation-local/src/main/java/com/powsybl/computation/local/WindowsLocalCommandExecutor.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128988357557255420261759310250235048582",
                "810391743413195549282492810927538439",
                "116951408524398562095943258244393681180",
                "162034835452069607152531645356646654637",
                "315557459238260418685684101763458461686",
                "88982044153717445034198458361076878086",
                "324524450752501847464236012490041594725",
                "328900974012425646131801515507808653153",
                "77769237583638215282609983706202202661",
                "70740936913639786364683136457514872219",
                "235747014825004715340607654629434098768",
                "33616745200356312762787558644925132599",
                "208688402170523109286372540855535255107",
                "103056524902589624970251152811013298865"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/powsybl/powsybl-core/commit/7aa28d8c2492bbcd061585cb498acce72d5ed79a",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55673.json"
vanir_signatures_modified 
"2026-08-30T08:17:24Z"