CVE-2026-108744

The pbi-cli tool, versions 3.10.1 through 3.12.0 , is vulnerable to an OS command injection within the desktop_sync.py component. The root cause is the passing of unquoted .pbip paths to cmd /c start when reopening projects. An attacker can lure a victim into opening a Power BI project from a spa...