CVE-2026-54325 json
Pi loads project-local extensions without approval
published 5mo ago modified 17d ago also EUVD-2026-38579 , GHSA-mqxh-6gq7-558m
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0.
Patch / fix
- npm @earendil-works/pi-coding-agent 0.79.0
Is CVE-2026-54325 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @earendil-works/pi-coding-agent | <0.79.0 |
0.79.0 |
Affected products
- earendil-works pi
Classification
- Weakness
-
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
References
-
github.com
/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c
web
-
github.com
/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390
web
-
github.com
/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4
web
-
github.com
/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49
web
-
github.com
/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350
web
-
github.com
/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m
web, advisory
-
github.com
/earendil-works/pi/releases/tag/v0.79.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-54325
advisory
-
github.com
/earendil-works/pi
package
Sources
- CVE List CVE-2026-54325
- GitHub Advisory GHSA-mqxh-6gq7-558m
- NVD CVE-2026-54325
- Maintainer advisory GHSA-mqxh-6gq7-558m
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of earendil-works/pi published their own advisory on GitHub. Reviewed sources take precedence over it.