Remote Code Execution Vulnerability in Pi by Earendil Works

CVE-2026-54325

What is CVE-2026-54325?

Pi, a minimal terminal coding harness, prior to version 0.79.0, improperly handled project-local configurations, allowing an attacker controlling a repository to execute untrusted JavaScript or TypeScript code. This risk arises when users run Pi from a compromised repository, as the project-local extensions could execute with the same permissions as the local Pi process, without prompting the user for trust verification. Users are advised to upgrade to version 0.79.0 to mitigate this security risk.

References