4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54325

CVE-2026-54325: Pi loads project-local extensions without approval

Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54325

CVE-2026-54325:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@earendil-works/pi-coding-agent	npm	< 0.79.0	0.79.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-mqxh-6gq7-558m, exists because Pi Agent versions prior to 0.79.0 would automatically load and process configuration and executable extensions from a project's .pi directory without user consent. An attacker could craft a malicious repository, and when a user runs pi within that repository, the agent would execute the attacker's code with the user's permissions.

The root cause is the lack of a trust boundary for project-local resources. The startup sequence would discover and load all resources from both user-level and project-level directories indiscriminately.

The patch introduces a "project trust" mechanism. Now, when pi starts in a directory containing project-local resources, it checks for a saved trust decision. If none exists, it prompts the interactive user for approval before loading any project-specific files. The core of the fix lies in modifying the resource and settings loaders to be aware of this trust state.

The identified vulnerable functions are key components of this unsafe loading process:

SettingsManager.fromStorage: Unconditionally loaded project settings (.pi/settings.json), which could be crafted to enable malicious extensions.
DefaultPackageManager.resolve: Unconditionally discovered resource paths, including executable extensions, from the untrusted project directory.
DefaultResourceLoader.reload: Orchestrated the loading process, taking the untrusted paths and executing the extension code.
loadProjectContextFiles: Loaded instructional files from the project, which, while less severe than code execution, was part of the same trust-violating behavior.

By exploiting this chain, an attacker could achieve arbitrary code execution on a victim's machine by tricking them into running pi in a malicious repository.

Vulnerable functions

DefaultPackageManager.resolve

packages/coding-agent/src/core/package-manager.ts

This function is responsible for discovering all resource paths for the agent to load. Before the patch, it would automatically include paths to resources found in the project's local `.pi` directory, such as extensions. This allowed an attacker to place a malicious extension in a repository, which would then be discovered and loaded by this function without user consent.

DefaultResourceLoader.reload

packages/coding-agent/src/core/resource-loader.ts

This function orchestrates the loading of all resources, including extensions. The vulnerable version of this function would take the list of all discovered resource paths (including untrusted ones from `DefaultPackageManager.resolve`) and load them directly. This is the function that triggers the loading and execution of a malicious project-local extension.

SettingsManager.fromStorage

packages/coding-agent/src/core/settings-manager.ts

This function loads settings from storage, including the project-specific `.pi/settings.json` file. Before the patch, it would load this file unconditionally. A malicious repository could define settings that point to and enable a malicious extension, which would then be loaded by the resource loader. This function represents an initial step in the exploitation chain.

loadProjectContextFiles

packages/coding-agent/src/core/resource-loader.ts

This function loads instructional context files (e.g., `AGENTS.md`) from the project directory. While not leading to direct code execution like extensions, its unconditional loading of project-controlled files was part of the overall vulnerability. It allowed an attacker to inject instructions into the agent without user approval, demonstrating the lack of a trust boundary that the patch addresses.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.