GHSA-f5cx-h789-j959

Suggest an improvement
Source
https://github.com/advisories/GHSA-f5cx-h789-j959
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-f5cx-h789-j959/GHSA-f5cx-h789-j959.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f5cx-h789-j959
Aliases
Published
2025-06-19T16:19:16Z
Modified
2025-06-20T16:25:12.264474Z
Severity
  • 8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
PowSyBl Core allows deserialization of untrusted SparseMatrix data
Details

Impact

What kind of vulnerability is it? Who is impacted?

This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method of the SparseMatrix class. This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an InputStream and the application parses it into a SparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the InputStream from external sources.

Am I impacted?

You are vulnerable if you import non-controlled serialized SparseMatrix objects.

Patches

com.powsybl:powsybl-math:6.7.2 and higher

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not use SparseMatrix deserialization (SparseMatrix.read(...) methods).

References

powsybl-core v6.7.2

Database specific 
{
    "github_reviewed_at": "2025-06-19T16:19:16Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "nvd_published_at": "2025-06-20T00:15:29Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Maven / com.powsybl:powsybl-math

Package

Name
com.powsybl:powsybl-math
View open source insights on deps.dev
Purl
pkg:maven/com.powsybl/powsybl-math

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.7.2

Affected versions

6.*

6.3.0
6.3.1
6.3.2
6.4.0-RC2
6.4.0
6.4.1
6.5.0-RC1
6.5.0
6.5.1
6.6.0-RC1
6.6.0
6.6.1
6.7.0-RC1
6.7.0
6.7.1

Database specific 

{
    "last_known_affected_version_range": "<= 6.7.1"
}