CVE-2026-108744: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MinaSaad1 pbi-cli

CVE-2026-108744 is an OS command injection vulnerability affecting MinaSaad1's pbi-cli tool in versions 3.10.1 through 3.12.0. The flaw exists in desktop_sync.py where .pbip file paths are passed unquoted to the Windows command shell, enabling injection of additional commands if the path contains special characters such as '&'. This can be exploited by tricking a user into opening a malicious Power BI project file from a specially crafted path, resulting in arbitrary command execution with the user's privileges.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the victim user during report write or reload operations. This can lead to unauthorized actions on the victim's system, potentially compromising confidentiality, integrity, and availability of local resources. The CVSS 4.0 base score is 7.3 (high severity), reflecting the local attack vector, low attack complexity, required user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening Power BI project files from untrusted or suspicious paths containing special characters such as '&'.