PowSyBl Core has Command Injection in LocalCommandExecutor-s
Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 (OS Command Injection), with a secondary CWE-88 (Argument Injection) concern via environment variables. The local command executor build command strings via concatenation and executes them (through bash -c for Unix, or cmd /c for Windows). Any string argument or environment variable value reaching this executor can break out of the intended command and execute arbitrary shell code as the JVM user. The …