Pi.Alert's SaveConfigFile() endpoint accepts user-supplied numeric configuration values and writes them directly into pialert.conf without validation. Since pialert.conf is executed by Python's exec() function every 3–5 minutes via a cron job, this allows an attacker to inject arbitrary Python code. Default installations with PIALERT_WEB_PROTECTION disabled do not require authentication, enabling unauthenticated remote code execution at the OS level. The vulnerability affects versions prior to 2026-05-07 and has been fixed in that release. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can achieve unauthenticated remote code execution on the underlying operating system by injecting arbitrary Python code through the vulnerable SaveConfigFile() endpoint. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to the ease of exploitation and the high impact on system security. No known exploits in the wild have been reported as of the published date.

The vulnerability was fixed in the 2026-05-07 release of Pi.Alert. Users should upgrade to version 2026-05-07 or later to remediate this issue. Since no official patch link or advisory is provided, users should verify the update from the vendor's official channels. Additionally, enabling PIALERT_WEB_PROTECTION may reduce exposure by requiring authentication, but the primary mitigation is applying the fixed version. Patch status is not explicitly confirmed beyond the stated fix date; users should consult the vendor for current remediation guidance.