Executive brief
PowSyBl Core is a Java library for power systems analysis used in grid simulation and contingency planning tools. The library's local command executor contains an OS command injection vulnerability that allows attackers to execute arbitrary shell commands with the privileges of the JVM process. Applications using PowSyBl—including REST APIs, data analysis platforms, and grid simulation services—are at risk if they accept user input for computation parameters or simulator options without sanitization.
Technical details
The vulnerability is a classic OS command injection (CWE-78) with secondary argument injection (CWE-88) affecting both UnixLocalCommandExecutor and WindowsLocalCommandExecutor. The root cause is unsafe string concatenation in command construction: Unix implementations use `bash -c` and Windows use `cmd /c` with user-controlled arguments and environment variables passed directly to shell execution. Multiple independent injection vectors exist: arguments can be bypassed via `$(...)` substitution, backticks, or escaped quotes; environment variables are unescaped and can be broken via `;`, newlines, or metacharacters. The sink is reachable through public APIs that accept `List<String>` without any indication elements undergo shell interpretation. Attack prerequisites are minimal (unprivileged network access in many deployment scenarios), and the impact is critical: arbitrary file read/write/execute, process spawning, and data exfiltration as the JVM user. Patch available in version 7.2.2 and later.
Affected products
- PowSyBl powsybl-computation-local <= 7.2.1
Timeline
- 2026-06-24: disclosed: Initially published to GitHub Advisory Database
- 2026-08-28: advisory: Updated in GitHub Advisory Database
- 2026: patched: Fixed in version 7.2.2