CVE-2026-54325 Details

A vulnerability exists in Pi, a terminal coding tool, prior to version 0.79.0, where project-local configurations and resources were loaded from a repository's .pi directory without user consent. This issue allowed project-specific extensions, executable TypeScript or JavaScript modules, to run with the same privileges as the local Pi process. An attacker controlling a repository could exploit this by placing malicious Pi resources that would execute when the user started Pi from that repository. The vulnerability is now fixed in version 0.79.0.

Users can upgrade to Pi version 0.79.0 or later, which includes project trust gating for local inputs. After upgrading, it's important to review project trust prompts carefully and only trust repositories whose Pi-specific configuration and extensions are acceptable to run.