CVE-2026-108744
pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
MinaSaad1 pbi-cli
CVSS
7.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.
Text from CVE List
Affected versions 1
- pbi-cliaffected: 3.10.1 through 3.12.0CVE List
References 5
- hackmd.io/@haind/pbi-cli-desktop-sync-pbip-cmd-argument-injectionAdvisoryvia CVE List
- vulncheck.com/advisories/pbi-cli-3.10.1-through-3.12.0-os-command-injection-via-desktop-syncAdvisoryvia CVE List
- github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L398-L405Referencevia CVE List
- github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L286-L291Referencevia CVE List
- github.com/MinaSaad1/pbi-cliReferencevia CVE List