CVE-2026-55673

PowSyBl (Power System Blocks) prior to 7.2.2 contains an OS command injection flaw (CWE-78, CWE-88) in its UnixLocalCommandExecutor and WindowsLocalCommandExecutor, which concatenate command arguments and environment variables into strings executed via bash -c or cmd /c without sufficient escaping. An attacker who controls values reaching these executors — for example contingency identifiers or computation parameters forwarded by itools action-simulator (with task-count), security-analysis with external, dynamic-security-analysis, or by downstream CLI tools, libraries, REST front ends and multi-tenant grid-analysis services — can break out of the intended command. Successful injection yields arbitrary shell command execution as the JVM user, reflected in the CVSS 4.0 score of 7.1 (high) with low integrity and high availability impact. Any deployment of PowSyBl before 7.2.2 is affected, particularly backend grid-analysis services and tooling that pass less-trusted input into the listed execute/run APIs. No public proof-of-concept or known exploitation exists; EPSS assigns a 0.4% probability of exploitation within 30 days and the issue is not in CISA's KEV catalog.

What to do: Upgrade PowSyBl to 7.2.2 or later. Until patched, restrict or validate any attacker-controlled strings (contingency identifiers, computation parameters, environment variables) before they reach the affected execute/run APIs, especially in itools action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Operators of REST front ends and multi-tenant grid-analysis services should audit whether untrusted user input is forwarded into these paths and treat those services as remotely exposed.