Pbi Cli
Monthly
OS command injection in pbi-cli 3.10.1 through 3.12.0 allows a local attacker to execute arbitrary commands with victim privileges when the victim opens a crafted Power BI .pbip project from a space-free filesystem path containing an '&' character. The flaw resides in desktop_sync.py, which passes unquoted paths to 'cmd /c start' during report write or reload, and exploitation requires user interaction (UI:P) with the crafted path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.0 score is 7.3 (High), and an independent CVSS 3.1 assessment yields 7.8 (High).
OS command injection in pbi-cli 3.10.1 through 3.12.0 allows a local attacker to execute arbitrary commands with victim privileges when the victim opens a crafted Power BI .pbip project from a space-free filesystem path containing an '&' character. The flaw resides in desktop_sync.py, which passes unquoted paths to 'cmd /c start' during report write or reload, and exploitation requires user interaction (UI:P) with the crafted path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.0 score is 7.3 (High), and an independent CVSS 3.1 assessment yields 7.8 (High).