[swang22]

Summary

• Validate the final resolved solver against the existing _SOLVER_OPTIONS allow-list in both hope_debug_solver_environment and hope_debug_solver_environment_async.
• Escape Julia $ interpolation in julia_string_literal.
• As additional defense-in-depth, pass caller-controlled solver names and case paths through Julia ARGS instead of embedding them in -e source, including the normal run, holistic, and EREC launch paths.
• Add regression coverage for explicit and settings-derived invalid solvers, both debug launch modes, argument separation, and literal $ handling.

Validation

• 31 upstream HOPE tests pass locally.
• A real HiGHS Julia environment probe completes with PROBE_STATUS=ok and HiGHS.Optimizer.
• All PowerMCP CI checks pass on Python 3.10, 3.12, 3.13, and 3.14, including the PowerFactory wheel smoke test.

Responsibly reported by @hexisteme. This implements both remediations proposed by the reporter, with the additional ARGS separation above. Reporter review is welcome before release.

The GitHub Security Advisory, reporter collaborator/credit, and CVE request should be coordinated separately by a PowerMCP repository maintainer.

[swang22]

@hexisteme Thank you for the proposed remediation. This PR implements both requested changes and adds argument-based separation as defense-in-depth. All local and upstream CI tests pass. Your review would be appreciated before release.

[hexisteme]

Reviewed — looks good to me, thanks for the fast and thorough fix.

It fully addresses the reported issue and goes further than I proposed: the _SOLVER_OPTIONS allow-list is now enforced in both hope_debug_solver_environment and the async variant (nice catch rejecting empty strings via is not None); julia_string_literal escapes $, closing interpolation at every call site; and passing case_path/solver through Julia ARGS instead of generated source is the right structural fix — it removes the injection class rather than filtering it. Regression tests for both the sync and async paths are present.

I also checked hope_run_erec: overrides_str only interpolates voll_override/delta_mw (typed float | None) and case_path now goes through the hardened literal, so I don't see a residual injection vector there.

LGTM to release. One request for the security side: could you publish a GitHub Security Advisory for this and request a CVE from the draft (GitHub is a CNA), crediting me (@hexisteme) as reporter? Happy to be added to the advisory draft if you enable Private Vulnerability Reporting. Thanks again!

[qian-harvard]

Reviewed and verified locally: the HOPE suite passes, and a real Julia run confirms that values passed through ARGS (including $(run(...))) arrive as literal text. Thanks @swang22 for the fix and @hexisteme for the report and review. This ships as 0.4.1, and advisory GHSA-6mvp-cq74-hhf5 is in draft.