CVE-2026-54325: Pi Terminal Coding Harness RCE Vulnerability

CVE-2026-54325 Overview

CVE-2026-54325 affects Pi, a minimal terminal coding harness developed by earendil-works. Versions prior to 0.79.0 load project-local configuration and resources from a repository's .pi directory without first prompting the user to trust the repository. These resources include project-local extensions, which are executable TypeScript or JavaScript modules loaded directly into the Pi process. An attacker who controls a repository can place malicious Pi-specific resources inside it. If a user then starts Pi from that working tree, the project-local extension code executes with the same privileges as the local Pi process. The issue is fixed in version 0.79.0 and is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Cloning and running Pi inside an attacker-controlled repository results in arbitrary code execution under the local user account without an explicit trust decision.

Affected Products

Pi (earendil-works/pi) versions prior to 0.79.0
Project-local extensions loaded from .pi directories in untrusted repositories
Workflows where Pi is launched inside cloned or shared working trees

Discovery Timeline

2026-06-23 - CVE-2026-54325 published to NVD
2026-06-25 - Last updated in NVD database
Fix released - Pi version 0.79.0 via GitHub Release v0.79.0

Technical Details for CVE-2026-54325

Vulnerability Analysis

Pi is designed as a terminal-based coding harness that loads project-specific configuration, context files, and extensions from a .pi directory in the current working directory. Project-local extensions are TypeScript or JavaScript modules executed within the Pi process. Prior to 0.79.0, Pi loaded these resources automatically whenever they were present, without prompting the user to confirm trust for the repository. An attacker who controls a Git repository can include a malicious .pi directory containing extension code. When a developer clones the repository and runs pi from the working tree, the malicious extension executes with the privileges of the user running Pi. This grants the attacker access to local files, environment variables, shell capabilities, and any credentials accessible to the user.

Root Cause

The root cause is missing trust gating around project-local resource loading. The hasProjectTrustInputs check did not enforce an explicit user trust decision before evaluating extension modules. The patch introduces a hasProjectConfigDir helper, a projectTrustOverride CLI flag, a persistent ProjectTrustStore, and a project_trust extension event so that resources from a .pi directory are only loaded after the user has trusted the project.

Attack Vector

Exploitation requires local execution: the victim must clone or download an attacker-controlled repository and run Pi from it. User interaction is required, but no privileges are needed by the attacker beyond the ability to publish a repository. The attack vector is consistent with supply chain risks for developer tooling that auto-loads project resources.

typescript

// Patch excerpt: packages/coding-agent/src/core/trust-manager.ts
// Introduces explicit project-config directory detection used by the
// new trust-gating logic.
export function hasProjectConfigDir(cwd: string): boolean {
	return existsSync(join(canonicalizePath(resolvePath(cwd)), CONFIG_DIR_NAME));
}

export function hasProjectTrustInputs(cwd: string): boolean {
	let currentDir = canonicalizePath(resolvePath(cwd));
	if (hasProjectConfigDir(currentDir)) {
		return true;
	}
}

Source: GitHub Commit 38f18be

Detection Methods for CVE-2026-54325

Indicators of Compromise

Presence of an unexpected .pi directory in cloned repositories, particularly containing .ts or .js files under an extensions subdirectory.
Pi process spawning unexpected child processes, opening outbound network connections, or reading sensitive files such as ~/.ssh/, ~/.aws/, or credential stores shortly after launch.
Unexpected writes to ~/.pi/agent/ or modifications to Pi configuration following execution in a new working tree.

Detection Strategies

Inventory developer endpoints for installed Pi versions and flag any instance below 0.79.0.
Hunt for .pi/extensions/*.ts and .pi/extensions/*.js files inside repositories cloned to developer workstations.
Correlate Pi process launches with subsequent file access to credential directories or unusual outbound connections via EDR telemetry.

Monitoring Recommendations

Enable command-line and process-tree logging for the pi binary on developer endpoints to capture working directory context.
Alert on file system events that create or modify files within .pi/ directories in source-controlled trees.
Monitor for network egress from the Pi process to non-corporate destinations, which may indicate extension-based exfiltration.

How to Mitigate CVE-2026-54325

Immediate Actions Required

Upgrade Pi to version 0.79.0 or later on all developer workstations using the GitHub Release v0.79.0.
Audit existing repositories on developer machines for unexpected .pi directories and review any extension code before re-running Pi in those trees.
Reset credentials that may have been exposed if Pi was executed inside untrusted repositories prior to upgrade.

Patch Information

The vulnerability is fixed in Pi 0.79.0. The remediation introduces explicit project trust gating, a ProjectTrustStore for persistent trust decisions, a projectTrustOverride CLI flag, and a new project_trust extension event. See the GitHub Security Advisory GHSA-mqxh-6gq7-558m and patch commits 38f18be, 718215b, and 89a9220 for implementation details.

Workarounds

Do not launch Pi from working trees of untrusted or newly cloned repositories until the upgrade is applied.
Inspect and remove any .pi directory present in a repository before running Pi from that location.
Run Pi inside an isolated container or sandbox account when evaluating untrusted code so that extension execution cannot reach sensitive credentials.

bash

# Upgrade Pi to the patched release
npm install -g @earendil-works/pi-coding-agent@0.79.0

# Verify installed version
pi --version

# Before running Pi in a freshly cloned repository, check for project resources
ls -la .pi 2>/dev/null && echo "Review .pi contents before launching pi"