What is the CVSS score of EUVD-2026-32635?

EUVD-2026-32635 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pi.Alert are affected by EUVD-2026-32635?

Pi.Alert, a widely-used open-source network intrusion detector with web-based management, contains a critical unauthenticated remote code execution flaw that allows attackers to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-32635?

Within 24 hours: Inventory all Pi.Alert deployments and assess network exposure of the web interface. Within 7 days: Upgrade all instances to version 2026-05-07 or later; if upgrade is delayed, immediately restrict network access to the web configuration interface via firewall rules and disable web protection features. Within 30 days: Verify complete deployment of patched versions, review access logs for unauthorized configuration changes, and implement network segmentation to isolate Pi.Alert management interfaces.

Pi.Alert EUVD-2026-32635

| CVE-2026-44887 CRITICAL

Code Injection (CWE-94)

2026-05-27 GitHub_M

Code Injection RCE Python

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 21:04 EUVD

Analysis Generated

May 27, 2026 - 20:16 vuln.today

DescriptionGitHub Advisory

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.

AnalysisAI

Unauthenticated remote code execution affects Pi.Alert, an open-source WiFi/LAN intruder detector with web-based service monitoring, in all versions prior to the 2026-05-07 release. The web configuration editor writes attacker-controlled content into pialert.conf, which the background scan daemon subsequently evaluates with Python's exec(), so injected statements run with the daemon's privileges. Because the product ships with web protection disabled by default, an attacker reaching the web interface needs no credentials, yielding a CVSS 9.8 critical flaw; no public exploit identified at time of analysis.

Technical ContextAI

Pi.Alert (vendor 'leiweibau', CPE cpe:2.3:a:leiweibau:pi.alert) is a Python-based network monitoring tool that stores its runtime settings in a plaintext configuration file, pialert.conf. Rather than parsing that file as inert data, the scanning daemon loads it through Python's exec() built-in, meaning the file's contents are treated as executable source. The web-based configuration editor lets users edit this file, so any value written there becomes code the daemon later runs. This maps directly to CWE-94 (Improper Control of Generation of Code, 'Code Injection'): the root cause is mixing a trusted code path (exec) with attacker-influenceable input (config fields) instead of using a safe key/value parser such as configparser or ast.literal_eval.

RemediationAI

Vendor-released patch: upgrade to the Pi.Alert release dated 2026-05-07 or later, as documented in advisory GHSA-r59g-5wf9-f7vv (https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-r59g-5wf9-f7vv). If immediate patching is not possible, enable Pi.Alert's web protection (authentication) feature, which is disabled by default - this restores the authentication requirement and removes the unauthenticated attack path, at the cost of requiring login for legitimate admins. As an additional compensating control, restrict network access to the Pi.Alert web interface to trusted management hosts via firewall rules or by binding it to localhost/a management VLAN, accepting the trade-off that remote administration becomes unavailable. Avoid exposing the configuration editor to untrusted networks under any circumstances until patched.