pbi-cli EUVD-2026-96909

Exploitation requires the victim to be running pbi-cli version 3.10.1 through 3.12.0 and to open, write, or reload a Power BI .pbip project that is located at a filesystem path which (a) contains no spaces and (b) contains an '&' character, so that desktop_sync.py's unquoted argument to 'cmd /c start' is reinterpreted by the Windows shell as a command separator. The attacker cannot execute remotely or without help: they must first place the malicious project at an attacker-controlled path and socially engineer the victim into opening it (UI:P). Limiting factors: local attack vector only (Windows 'cmd' implies a Windows host), mandatory user interaction, dependence on a non-default crafted path, and the fact that paths containing spaces defeat the specific injection - all of which constrain this to targeted scenarios rather than broad exploitation.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scoring 7.3 (High), which is internally consistent with the description: the attack is LOCAL (AV:L), needs no attacker privileges (PR:N), but hinges on passive user interaction (UI:P - the victim opening a project) plus a specific attack requirement (AT:P - a crafted, space-free path containing '&'). Impact is high across confidentiality, integrity, and availability because arbitrary commands run with the victim's privileges. No EPSS score is provided, there is no CISA KEV listing, and no POC=YES flag is present in the input, so exploitation status is 'no public exploit identified at time of analysis' - although a detailed hackmd write-up and direct source-line references exist, which lowers the barrier to weaponization. Weighing these signals together, this is a genuine but NOT top-tier priority: the LOCAL vector, required user interaction, and specific non-default path condition make mass/automated exploitation implausible, pointing instead toward targeted social-engineering against developers using this specific niche CLI. The absence of EPSS/KEV data is a gap (not an error), so real-world exploitation probability cannot be quantified from the provided data.

An attacker crafts or renames a Power BI (.pbip) project so it resides at a space-free filesystem path containing an '&' character (e.g. delivered via a shared repo, zip, or network share) and lures a pbi-cli user into opening it. When the victim reopens, writes, or reloads the report, desktop_sync.py passes the unquoted path to 'cmd /c start', and the shell interprets the '&' as a command separator, executing attacker-chosen commands with the victim's privileges. No public exploit is identified in the input, but a step-by-step hackmd analysis and the exact vulnerable source lines are publicly referenced, materially easing exploit development.