CVE-2026-108744
Received Received - Intake

OS Command Injection in pbi-cli via Unquoted Project Paths

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108744
EUVD
EUVD-2026-96909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MinaSaad1 pbi-cli 3.10.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in pbi-cli versions 3.10.1 through 3.12.0. It occurs in the desktop_sync.py module when unquoted .pbip paths containing spaces are passed to the cmd /c start command during project reopening. Attackers can exploit this by tricking victims into opening a Power BI project from a path with the & character, allowing arbitrary command execution with victim privileges during report operations.

Detection Guidance

Check if pbi-cli versions 3.10.1 through 3.12.0 are installed by running: pbi --version. Inspect desktop_sync.py for cmd /c start usage with unquoted .pbip paths. Monitor Power BI Desktop command line arguments for paths containing & or other metacharacters.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary commands on your system with your privileges. This could lead to data theft, system compromise, or further lateral movement within your network. The attack requires user interaction, such as opening a malicious project file, but can occur during normal report write or reload operations.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected pbi-cli versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Upgrade pbi-cli to a patched version if available. Disable auto-sync in Power BI Desktop settings. Replace cmd /c start with os.startfile(pbip_path) in desktop_sync.py. Avoid opening Power BI projects from untrusted paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart