Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44887Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)

Critical 9.8

In plain English

A critical-severity code injection in Pi.Alert from leiweibau. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.

Affected products (as reported)

Vendor	Product	Versions
leiweibau	Pi.Alert	< 2026-05-07

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-r59g-5wf9-f7vv x_refsource_CONFIRM