Pi.Alert, a WIFI/LAN intruder detector with web service monitoring, had a critical vulnerability (CVE-2026-44887) in its web-based configuration editor that allowed arbitrary Python code injection into its configuration file (pialert.conf). Because the background scan daemon executes this configuration file using Python's exec(), any injected code runs with the daemon's privileges. The default configuration disables web protection, enabling unauthenticated remote attackers to exploit this vulnerability. The issue is classified under CWE-94 (Improper Control of Generation of Code). The vulnerability was fixed in the release dated 2026-05-07.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary Python code on the system running Pi.Alert, leading to full compromise of the daemon process. This can result in complete system control, data compromise, or disruption of the intruder detection service. The CVSS 3.1 base score of 9.8 reflects the critical nature with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix for this vulnerability is available in Pi.Alert version 2026-05-07 and later. Users should upgrade to this version or newer to remediate the issue. Until the upgrade is applied, enabling web protection to require authentication may reduce exposure, but the vendor advisory does not specify alternative mitigations. Patch status is confirmed fixed as of 2026-05-07.