Power Grid Model has completed an independent security audit, and all three findings are fixed. The audit was performed by Shielder, coordinated by the Open Source Technology Improvement Fund (OSTIF), and sponsored by LF Energy. Security audits of this type are a helpful tool in ensuring the safety and security of open source technologies being relied upon for essential tasks.
Power Grid Model is an open source library for steady-state distribution power system analysis, developed by Alliander and hosted at LF Energy. It has crossed 10 million downloads and runs in production at Alliander, Enexis, and Stedin, the three major Dutch distribution system operators (DSOs). It is used across grid planning, expansion, reliability, and congestion studies.
Shielder found the C++ core and the C API boundary to follow secure coding principles. The Python package validates its inputs, which keeps one of the C API findings unreachable from Python.
Audit Scope and Methodology
Two Shielder security engineers worked on the engagement for 20 person-days. The review covered the core C++ library, the C API shim, and the Python package. It also covered the auxiliary power-grid-model-io library, included because of how often it feeds data into Power Grid Model.
Shielder began with threat modeling, studying how users install, configure, and run the library. Power Grid Model is a library, so its attack surface is the data an embedding application passes to it. The review therefore concentrated on the deserialization pipeline, the C API boundary, and the file ingestion layer.
The audit combined:
- Threat modeling to identify high-risk entry points and attack scenarios
- Manual source code review focused on memory safety, integer arithmetic, and deserialization patterns
- Static analysis with Semgrep and publicly available C and C++ rules
- A fuzzing campaign using a coverage-guided, OSS-Fuzz compatible fuzzer with a custom mutator
- A review of the release process and GitHub workflow configuration for supply chain exposure
Fuzzing Built for the Maintainers
Shielder first built a single end-to-end fuzzing harness. At the maintainers’ request, it was refactored into seven smaller harnesses so each is easier to maintain over time. Each one covers a single stage: parsing the document, writing it into buffers, building the model, running power flow, state estimation, or short circuit calculations, and applying batch updates. A change to one part of the library only touches the harness for that part, and each stage can be fuzzed at its own speed and depth.
The harnesses were submitted to the project, together with a seed corpus, a dictionary, and the configuration needed to onboard Power Grid Model to OSS-Fuzz, so fuzzing can continue after the audit.
Key Findings and Outcomes
The audit identified three findings with security impact: one high, one medium, and one low. All three are fixed.
- High: arbitrary method invocation via YAML mapping (CVE-2026-84457). In power-grid-model-io, the Tabular Converter let a YAML mapping file reference any importable Python function. Exploitation required the ability to supply or modify a mapping loaded by an application. Fixed in Power-Grid-Model-IO 2.0, which adds an allowlist of functions for tabular converter configuration.
- Medium: unbounded JSON nesting (CVE-2026-76912). Deeply nested JSON passed to the deserializer could exhaust memory in the host process. Fixed by a depth check that limits JSON and msgpack nesting (PR #1467), released in Power Grid Model 1.13.111.
- Low: out-of-bounds memory access in span calculation (CVE-2026-76911). The C API accepted index arrays for non-uniform batch data without checking ordering or bounds. This input is not reachable through the Python library, which already validates it. Fixed by hardening the index array checks (PR #1470).
Each finding was reported through the GitHub Security section of the relevant repository, and the maintainers triaged and fixed them. Shielder’s guidance for services that process third-party data is to treat YAML mappings as code, load them only from trusted sources, and run current releases of both libraries.
The report also gives the maintainers a clear roadmap for continued security work:
- Pin the pgm-build-dependencies release by SHA-256 hash in CI and in pyproject.toml
- Publish a CycloneDX or SPDX software bill of materials (SBOM) with each release
- Keep narrow_cast integer checks active in release builds
- Enable UBSan in the unix-sanitizer preset
As with any security assessment, the audit is a point-in-time review and cannot guarantee that software is free of bugs. Shielder recommends a more in-depth audit of the C++ codebase as a longer term step.
Strengthening Security Through Open Collaboration
A public audit lets every organization that runs Power Grid Model see what was reviewed, what was found, and what was fixed. The report, the advisories, and the fixes are all public.
This engagement brought together:
- The Power Grid Model maintainers and community, who triaged and fixed each finding
- Shielder, which performed the audit and built the fuzzing harnesses
- OSTIF, which coordinated the engagement
- LF Energy, which sponsored the work and hosts the project
OSTIF’s announcement and Shielder’s technical write-up cover the audit from their own perspectives.
LF Energy thanks the Power Grid Model maintainers and community, especially Peter Salemink and Santiago Figueroa Manrique of Alliander. Thanks also go to the Shielder team of Mattia Ricciardi, Pietro Tirenna, and Abdel Adim ‘smaury’ Oisfi, and to OSTIF for its coordination and stewardship.
Read the Full Report
The full report, including the threat model findings, reproduction steps, and recommended mitigations, is publicly available.
The findings, the fixes, and the report are all public, so every organization building on Power Grid Model can see where the project stands.
Frequently Asked Questions
Which releases include the fixes?
Power Grid Model 1.13.115 and later, and Power-Grid-Model-IO 2.0 and later, include the fixes for all three findings.
Which organizations run Power Grid Model in production?
Alliander, Enexis, and Stedin, the three major Dutch DSOs, run it in production. Soptim in Germany, RSE in Italy, TU Delft, and TU Eindhoven also use it. The library has crossed 10 million downloads.
What does the audit cover, and what are its limits?
It covers the core C++ library, the C API, the Python package, and power-grid-model-io, plus the release process and GitHub workflows. It is a time-boxed review of the April 20, 2026 code, so it cannot guarantee the absence of bugs. A deeper audit of the C++ codebase is the recommended next step.
Where can I find the source code and documentation?
On the Power Grid Model project page and the GitHub repository.