Threat database

1 threat

Threat database
Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.3	EPSS 0.5%	CVE-2026-108744pbi-cli · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in… High7.3EPSS 0.5%2026-10-11CVE Database V5CVE-2026-108744 pbi-cli versions 3.10.1 through 3.12.0 have an OS command injection vulnerability in the desktop_sync.py component. The issue arises because unquoted .pbip file paths containing special characters like '&' are passed to the Windows command shell (cmd /c start) when reopening projects. This allows attackers to execute arbitrary commands with the victim's privileges if the victim opens a crafted Power BI project file. The vulnerability has a CVSS 4.0 score of 7.3, indicating high severity. EPSS 0.5%Vulnerability MinaSaad1 #ghsa-jvcc-r2cm-664x	CVE Database V5	2026-10-11

Showing 1–1 of 1 result