CVE-2026-44887: Pi.Alert RCE Vulnerability

CVE-2026-44887 Overview

CVE-2026-44887 is an unauthenticated remote code execution vulnerability in Pi.Alert, an open-source WiFi and LAN intruder detector with web service monitoring. The flaw resides in the web-based configuration editor, which writes user-supplied input directly into pialert.conf. The background scan daemon subsequently loads this configuration file using Python's exec() function, executing any injected Python code with daemon privileges. When the default web protection setting is disabled, no authentication is required to reach the configuration editor. The issue is tracked under CWE-94: Improper Control of Generation of Code and is fixed in the 2026-05-07 release.

Critical Impact
Network-reachable attackers can execute arbitrary Python code as the Pi.Alert daemon without credentials, leading to full host compromise.

Affected Products

Pi.Alert versions released prior to 2026-05-07
Pi.Alert deployments running the web-based configuration editor
Pi.Alert instances with web protection disabled (default configuration)

Discovery Timeline

2026-05-07 - Patched release published by the Pi.Alert maintainers
2026-05-27 - CVE-2026-44887 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44887

Vulnerability Analysis

Pi.Alert exposes a web interface that allows administrators to edit the runtime configuration stored in pialert.conf. The web editor performs no syntactic validation or sandboxing on the values written to this file. The background scanner daemon reads the configuration by invoking Python's built-in exec() against the file contents, treating the file as executable code rather than data. Any Python statement placed in the configuration is therefore executed inside the daemon process on the next scan cycle.

Because web protection is off by default, the configuration editor endpoint is reachable without authentication on any network where the Pi.Alert UI is exposed. The daemon typically runs with elevated privileges to perform ARP scans and packet inspection, so injected code inherits those privileges.

Root Cause

The root cause is the use of exec() to parse configuration data, combined with missing input validation and missing authentication on the configuration editor in the default deployment. This pattern conflates code and configuration, a classic CWE-94 code injection condition.

Attack Vector

An attacker sends an HTTP request to the configuration editor endpoint containing arbitrary Python statements. The server writes the payload into pialert.conf. When the scanner daemon next reloads the configuration, exec() evaluates the payload, granting the attacker code execution as the daemon user. Refer to the GitHub Security Advisory GHSA-r59g-5wf9-f7vv for technical specifics.

Detection Methods for CVE-2026-44887

Indicators of Compromise

Unexpected modifications to pialert.conf, particularly entries containing Python keywords such as import, os.system, subprocess, or __import__
Child processes spawned by the Pi.Alert scanner daemon that are not part of normal scan activity (shells, network utilities, package managers)
Outbound network connections initiated from the Pi.Alert host to unknown destinations
New cron jobs, systemd units, or SSH keys created on the Pi.Alert host

Detection Strategies

Monitor file integrity on pialert.conf and alert on writes from the web service that include Python control flow tokens
Inspect web server access logs for POST requests to the configuration editor endpoint from untrusted source addresses
Baseline the process tree of the Pi.Alert daemon and alert on deviations such as interpreter or shell child processes

Monitoring Recommendations

Forward Pi.Alert host logs, web access logs, and process telemetry to a centralized analytics platform for correlation
Track outbound connections from the Pi.Alert host and flag any traffic to non-LAN destinations
Review authentication settings periodically to confirm web protection has not reverted to the default disabled state

How to Mitigate CVE-2026-44887

Immediate Actions Required

Upgrade Pi.Alert to the 2026-05-07 release or later, which removes exec()-based configuration loading
Enable web protection and configure strong credentials for the Pi.Alert web interface
Restrict network access to the Pi.Alert UI to trusted management networks only
Inspect pialert.conf for unauthorized modifications and review the host for signs of post-exploitation activity

Patch Information

The maintainers fixed the issue in the Pi.Alert release dated 2026-05-07. Refer to the GitHub Security Advisory GHSA-r59g-5wf9-f7vv for the patched commit and release notes.

Workarounds

Place the Pi.Alert web interface behind a reverse proxy that enforces authentication and IP allow-listing
Enable the built-in web protection feature so that the configuration editor requires authentication
Run the Pi.Alert daemon under a least-privilege account and within a container or namespace to limit blast radius if exploited

bash

# Example: restrict access to the Pi.Alert UI with an nginx allow-list
location /pialert/ {
    allow 10.0.0.0/24;       # trusted management subnet
    deny  all;
    auth_basic           "Pi.Alert";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:8080;
}