CVE-2026-55673: PowSyBl Core has Command Injection in LocalCommandExecutor-s

Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 (OS Command Injection), with a secondary CWE-88 (Argument Injection) concern via environment variables.

The local command executor build command strings via concatenation and executes them (through bash -c for Unix, or cmd /c for Windows). Any string argument or environment variable value reaching this executor can break out of the intended command and execute arbitrary shell code as the JVM user.

The sink is reachable through public APIs that accept List<String> arguments without any documented indication that elements undergo shell interpretation.

Any caller — CLI, library integration, or embedding service — that forwards data from a less-trusted source into these APIs inherits the vulnerability.