CVE-2026-55673: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in powsybl powsybl-core

PowSyBl-core versions before 7.2.2 contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in command execution. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor classes concatenate command arguments and environment variables into strings executed by bash -c or cmd /c without sufficient escaping. Attacker-controlled inputs reaching several execute methods can break out of the intended command context and run arbitrary shell commands as the JVM user. This affects various tools and services that forward less-trusted parameters into these APIs. The vulnerability is resolved in version 7.2.2.

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the JVM user running powsybl-core, potentially leading to unauthorized system access or control. Remote exploitation is possible through downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that pass untrusted input to the vulnerable APIs. This elevates the risk of system compromise in affected environments.

This vulnerability is fixed in powsybl-core version 7.2.2. Users should upgrade to version 7.2.2 or later to remediate the issue. No official patch or temporary fix is indicated other than upgrading. Until upgraded, avoid passing untrusted input to the affected command execution APIs to reduce risk.