Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python c…

Pi.Alert WIFI/LAN intruder detector contains a critical remote code execution vulnerability in its web-based configuration editor. The flaw allows arbitrary Python code injection into pialert.conf file, which executes via the background scan daemon process. With web protection disabled by default, no authentication is required, making this an unauthenticated RCE vulnerability. The vulnerability affects versions prior to 2026-05-07 and has been patched in the latest release.