What is the CVSS score of CVE-2026-44888?

CVE-2026-44888 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pi.Alert are affected by CVE-2026-44888?

Pi.Alert, a Python-based network monitoring tool, contains an unauthenticated remote code execution vulnerability (CVSS 9.8) affecting all versions released before the 2026-05-07 patch.. A patch is available.

How to fix or mitigate CVE-2026-44888?

Within 24 hours: Inventory all Pi.Alert installations; if PIALERT_WEB_PROTECTION is disabled or unknown, immediately restrict network access to the web UI or take the service offline. Within 7 days: Apply vendor patch released 2026-05-07 to all instances; verify PIALERT_WEB_PROTECTION=True is set in pialert.conf. Within 30 days: Review pialert.conf file modification timestamps and cron job logs (3-5 minute execution cadence) for exploitation indicators; confirm 100% patch compliance.

Pi.Alert CVE-2026-44888

EUVD-2026-32634 CRITICAL

Code Injection (CWE-94)

2026-05-27 GitHub_M

Code Injection RCE Python

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 21:04 EUVD

Analysis Generated

May 27, 2026 - 20:18 vuln.today

DescriptionGitHub Advisory

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes user-supplied numeric config values (e.g., SMTP_PORT) directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec() every 3-5 minutes by the background cron process, an attacker can inject arbitrary Python code and achieve unauthenticated OS-level RCE. On default installations (PIALERT_WEB_PROTECTION = False), no credentials are required. This vulnerability is fixed in 2026-05-07.

AnalysisAI

Unauthenticated remote code execution affects Pi.Alert, a Python-based Wi-Fi/LAN intruder detector, in all releases prior to the 2026-05-07 fix. The web UI's SaveConfigFile() endpoint writes attacker-supplied numeric configuration values such as SMTP_PORT into pialert.conf with no validation, and because that file is reloaded via Python's exec() by a background cron job every 3-5 minutes, injected Python executes at the OS level. On default installations (PIALERT_WEB_PROTECTION = False) no credentials are required, matching the CVSS 9.8 network/no-privilege rating; there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but trivial complexity and full CIA impact make it a high-priority patch.

Technical ContextAI

Pi.Alert (the leiweibau fork, per CPE cpe:2.3:a:leiweibau:pi.alert) is a self-hosted network monitoring tool that scans the LAN/Wi-Fi for new or unauthorized devices and performs web-service monitoring. Its configuration is stored in pialert.conf as Python assignment statements, which the back-end loads by passing the file contents to Python's exec() rather than parsing it as inert data. The vulnerability is a classic CWE-94 (Improper Control of Generation of Code / code injection): a user-controlled value reaches a code-evaluation sink. Because SaveConfigFile() trusts that fields like SMTP_PORT are numeric and writes them verbatim, an attacker can break out of the intended integer assignment and append arbitrary Python that the scheduled exec() will run with the privileges of the cron/back-end process.

RemediationAI

Vendor-released patch: upgrade to the Pi.Alert 2026-05-07 release (the project uses date-based versioning rather than semantic version tags), as documented in advisory GHSA-xg85-f8qw-7c5f (https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-xg85-f8qw-7c5f). Until the upgrade is applied, the most direct compensating control is to set PIALERT_WEB_PROTECTION = True so the web interface requires authentication, which removes the unauthenticated path but does not by itself fix the underlying exec()-based config loading, so an authenticated attacker could still inject code. Additionally, restrict network access to the Pi.Alert web service to trusted management hosts via firewall rules or a reverse proxy with authentication, and avoid exposing the UI to the internet; the trade-off is reduced remote administration convenience. Where feasible, run the back-end/cron process under a least-privileged, non-root account to limit the blast radius of any successful injection.