CVE-2026-54325: Pi Terminal Code Execution via Untrusted Project Extensions

Technical summary

CVE-2026-54325 is a privilege abuse vulnerability in Pi versions before 0.79.0 arising from unsafe automatic loading of project-local extensions. The vulnerability stems from a failure to implement a trust boundary before executing untrusted code. When Pi initializes from a repository root, it traverses the `.pi` directory and dynamically loads TypeScript and JavaScript modules as extensions without prior user consent or trust verification. An attacker-controlled repository can leverage this to achieve arbitrary code execution in the context of the local user running Pi. The vector indicates local attack surface (AV:L) with low complexity (AC:L), no privilege requirement (PR:N), and user interaction (UI:R) needed to trigger the initial Pi invocation. The impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact (A:N).

Business impact

For development teams relying on Pi for terminal-based coding workflows, this vulnerability creates supply-chain risk when cloning or switching between repositories. A compromised or attacker-controlled open-source project could silently execute code on developers' machines during routine development setup. This could lead to credential theft, source code exfiltration, or lateral movement into internal networks. Organizations using Pi should treat this as a code-execution risk vector equivalent to malicious npm packages or other dependency-based attacks, requiring both patching and awareness training for developers.

Affected systems

Pi versions prior to 0.79.0 are affected. The vulnerability applies universally to any installation running an older version, regardless of operating system, since the attack vector is file-system-based and the loading mechanism is agnostic to platform. Users running Pi 0.79.0 or later are not affected. The vendor list is empty, indicating Pi is the sole affected product in this CVE's scope.

Exploitability

Exploitability is straightforward but requires user action. An attacker must control or modify a Git repository (public or private) that a target user will clone and open with Pi. The exploit requires no special privileges on the target system and executes with the same user context as Pi. The user interaction requirement (UI:R in the CVSS vector) is met by the routine action of running Pi in a cloned repository—a normal part of development workflows. There is no authentication bypass or network component; this is purely a local code-execution issue triggered by directory traversal and unsafe module loading.

Remediation

Upgrade Pi to version 0.79.0 or later immediately. This version implements a trust verification mechanism before loading project-local extensions, preventing automatic execution of untrusted code. Verify the upgrade in your package manager or build environment. For organizations with development machines still running older Pi versions, prioritize patching as part of regular dependency management. Additionally, audit any repositories that may have been used in development environments while running vulnerable Pi versions to identify whether malicious `.pi` directories were injected.

Patch guidance

1. Identify all machines and CI/CD pipelines running Pi by checking version with `pi --version` or equivalent. 2. Update Pi to 0.79.0 through your package manager (npm, pip, homebrew, etc., depending on installation method). 3. For development teams, update installation instructions and onboarding documentation to require Pi 0.79.0+. 4. If using Pi in automated build or CI/CD pipelines, update lock files and container images to pin Pi 0.79.0 or later. 5. Verify the upgrade in a test environment before rolling out broadly. 6. Document the patching action in your vulnerability management system.

Detection guidance

Look for Pi processes running version numbers below 0.79.0 using package inventory tools or scanning installed software on developer workstations. Check build system logs and CI/CD configuration files for Pi version pinning. Monitor for `.pi` directories appearing in repositories or for suspicious script execution originating from `.pi` paths. If forensic analysis is needed on potentially compromised machines, examine process execution logs for unsigned or unexpected TypeScript/JavaScript module loads initiated from `.pi` directories during development sessions. Endpoint detection tools can flag execution chains where Pi spawns subprocess shells or makes unusual outbound connections immediately after initialization.

Why prioritize this

Although rated MEDIUM severity (CVSS 4.4), this vulnerability warrants prompt patching because it represents silent, automatic code execution in a development context where trust is often implicitly granted to project configurations. The attack surface is broad—any developer cloning a malicious repository is at risk—and the impact could cascade into internal network compromise if the developer's machine has access to sensitive systems. The lack of a KEV listing does not diminish the practical risk; it reflects that this is a relatively new or low-volume threat rather than an indication of low exploitability. Development teams should patch within 1–2 weeks of release.

Risk score, explained

The CVSS 3.1 score of 4.4 (MEDIUM) reflects the combination of local attack vector, low complexity, user interaction requirement, and limited scope. The score appropriately discounts the attack because it requires the user to initiate Pi in an attacker-controlled directory. However, the practical risk is amplified by the fact that cloning and opening repositories is a routine developer action, making the 'user interaction' requirement almost trivial to satisfy. Organizations should apply risk weighting beyond the base score: add points for high-value developer machines, for repositories frequently shared across teams, and for development workflows with direct access to production systems.

Frequently asked questions