pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

Advisories

pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

severity: high
date: 10/11/2026
Affecting: pbi-cli >= 3.10.1, <= 3.12.0
CVE: CVE-2026-108744
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: 7.3
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind/pbi-cli-desktop-sync-pbip-cmd-argument-injection
https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L398-L405
https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L286-L291
https://github.com/MinaSaad1/pbi-cli
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo