TI-2026-70722 CVE-2026-108744 · GHSA-jvcc-r2cm-664xOS command injection in pbi-cli Desktop Sync via .pbip pathsPriority LOW 35pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects.CVSS 4.0HIGH 7.3· Local · No auth · User interaction · EPSS 0.00547 · Published 2026-10-11 · No fix listed CWE-78
