CVE-2026-108744
Description
A flaw was found in pbi-cli. This flaw allows an attacker to execute arbitrary commands by tricking a user into opening a Power BI project located in a specially crafted directory path. Because the utility passes unquoted project paths to the Windows command shell when reopening projects, embedded command characters are executed with the privileges of the targeted user.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires local user interaction to trigger an untrusted project file path. Furthermore, the issue relies on Windows command execution mechanics and does not impact standard Linux deployment environments. Red Hat does not ship or support the pbi-cli utility in any of its enterprise products.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
