Aslein1413-Sys

**Name of the Vulnerable Software and Affected Versions** Pi.Alert versions prior to 2026-05-07 **Description** The web-based configuration editor allows the injection of arbitrary Python code into the `pialert.conf` file. Because the background scan daemon utilizes the `exec()` function to load this file, the injected code is executed with the privileges of the daemon process. When web protection is disabled, which is the default setting, this allows for unauthenticated Remote Code Execution (RCE), a process where an attacker can execute commands on a remote machine over a network. **Recommendations** Update to the version released on 2026-05-07.

**Name of the Vulnerable Software and Affected Versions** Pi.Alert versions prior to 2026-05-07 **Description** The `SaveConfigFile()` endpoint writes user-supplied numeric configuration values, such as `SMTP PORT`, directly into the `pialert.conf` file without validation. Because the background cron process loads `pialert.conf` using the Python `exec()` function every 3 to 5 minutes, an attacker can inject arbitrary Python code to achieve unauthenticated operating system-level remote code execution (RCE). On default installations where `PIALERT WEB PROTECTION` is set to `False`, no credentials are required to exploit this issue. **Recommendations** Update to the version released on 2026-05-07.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.50 **Description** GitPython fails to validate newline characters in the section parameter of the `config writer()` function. This allows an attacker to inject arbitrary section headers into the `.git/config` file. By injecting newlines, an attacker can create a forged `[core]` section and modify the `hooksPath` variable to point to a directory under their control. This can lead to remote code execution when git hooks are triggered. **Recommendations** Update GitPython to version 3.1.50 or later. As a temporary workaround, restrict user-controlled input from being passed to the section parameter of the `config writer()` function.