Pi.Alert’s web‐based configuration editor permits unfiltered Python code to be written into pialert.conf. When the background scan daemon later loads this configuration file with Python’s exec() function, the injected code runs with the same privileges as the daemon process, allowing an attacker to execute arbitrary commands on the host. This provides full compromise of the underlying system, including data exfiltration, persistence, or further lateral movement.

The affected product is Pi.Alert, a Wi‑Fi and LAN intruder detector developed by leiweibau. Any installation distributed prior to the release dated 2026‑05‑07 is vulnerable; the advisory notes that the issue was fixed in that update. No specific version numbers are listed beyond the date of the fix.

The CVSS score of 9.8 indicates a critical severity. The exploit probability is not quantified in EPSS, and the vulnerability is not yet in the CISA KEV catalog. The logical attack path requires access to the web interface with web protection disabled, which is the default configuration. Because no authentication is required, an unauthenticated user who can reach the web service can inject code and trigger execution, making exploitation straightforward for anyone with network connectivity to the target.