Is CVE-2026-44887 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44887 being exploited in the wild.

How severe is CVE-2026-44887?

Critical severity, with a CVSS score of 9.8, published 27 May 2026.

Which products and versions are affected?

Leiweibau Pi.Alert Prior to 2026-05-07.

Is there a fix for CVE-2026-44887?

A patch was published on 2026-05-07: Vulnerability fixed in version 2026-05-07 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44887 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44887?

Check whether you run Leiweibau Pi.Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44887: Pi.Alert Python code injection in configuration editor

CVE-2026-44887 · Severity: critical · CVSS 9.8 · Published 2026-05-27

Pi.Alert is a network security tool used to monitor WIFI and LAN networks for unauthorized devices. A vulnerability in its web-based configuration editor allows an attacker to take full control of the system by injecting malicious code into the configuration file. Because the software's default settings do not require a password, any remote attacker can exploit this to execute commands with high-level system privileges, potentially leading to a total compromise of the network monitoring device.

Technologies: Leiweibau Pi.Alert. Vendors: Leiweibau.

Quick answers

Is CVE-2026-44887 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44887 being exploited in the wild.
How severe is CVE-2026-44887?: Critical severity, with a CVSS score of 9.8, published 27 May 2026.
Which products and versions are affected?: Leiweibau Pi.Alert Prior to 2026-05-07.
Is there a fix for CVE-2026-44887?: A patch was published on 2026-05-07: Vulnerability fixed in version 2026-05-07 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44887 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44887?: Check whether you run Leiweibau Pi.Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in Pi.Alert's web-based configuration editor due to improper sanitization of user-supplied input in 'front/php/server/files.php'. Specifically, the 'SaveConfigFile' action writes the 'DB_PATH' and 'LOG_PATH' keys to 'pialert.conf' without surrounding quotes. Because the background scan daemon ('back/pialert.py') loads this configuration file using Python's 'exec()' function, any injected Python code is executed in the context of the daemon process, which typically runs with root privileges. Since 'PIALERT_WEB_PROTECTION' is disabled by default, the vulnerability is exploitable by unauthenticated remote attackers. The issue is resolved in the 2026-05-07 update.

Affected products

leiweibau Pi.Alert Prior to 2026-05-07

Timeline

2026-05-07: patched: Vulnerability fixed in version 2026-05-07
2026-05-08: advisory: GitHub Security Advisory published
2026-05-27: disclosed: CVE-2026-44887 published to NVD

References

https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-r59g-5wf9-f7vv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.