PowSyBl, a framework used to build power‑system oriented software, contains a command injection flaw in its LocalCommandExecutor components. The flaw stems from concatenating untrusted command arguments and environment variables into strings that are later interpreted by bash or cmd without proper escaping. When an attacker supplies crafted input, the injected payload can break out of the intended command structure and be executed by the underlying operating system with the privileges of the Java Virtual Machine process. This directly provides the attacker with full code execution capabilities on the host machine.

The vulnerability affects versions of PowSyBl core prior to 7.2.2, including the UnixLocalCommandExecutor, WindowsLocalCommandExecutor, LocalComputationManager, ParallelLoadFlowActionSimulator, ActionSimulatorTool, AmplModelRunner, and their asynchronous variants. Downstream components such as action-simulator, security-analysis, and dynamic-security-analysis that forward potentially untrusted contingency identifiers or computation parameters to these execution paths are also impacted. The issue is fixed in PowSyBl core 7.2.2 and later releases.

The CVSS score of 7.1 reflects a moderate to high severity, indicating that successful exploitation leads to complete compromise of the system. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog, so the real‑world exploitation probability is currently uncertain. However, the flaw is exploitable through externally accessible interfaces—such as REST APIs, command‑line tools, and multi‑tenant services—that accept untrusted input. An attacker who can forge such input can gain arbitrary code execution as the JVM user, potentially escalating to full system control.