CVE-2026-54325

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54325", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T18:42:02.224Z", "datePublished": "2026-06-23T19:22:55.043Z", "dateUpdated": "2026-06-23T19:44:45.699Z"}, "containers": {"cna": {"title": "Pi loads project-local extensions without approval", "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m"}, {"name": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c"}, {"name": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390"}, {"name": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4"}, {"name": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49"}, {"name": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350"}, {"name": "https://github.com/earendil-works/pi/releases/tag/v0.79.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/releases/tag/v0.79.0"}], "affected": [{"vendor": "earendil-works", "product": "pi", "versions": [{"version": "< 0.79.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:22:55.043Z"}, "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0."}], "source": {"advisory": "GHSA-mqxh-6gq7-558m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T19:44:24.627687Z", "id": "CVE-2026-54325", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T19:44:45.699Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54325", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T18:42:02.224Z", "datePublished": "2026-06-23T19:22:55.043Z", "dateUpdated": "2026-06-23T19:44:45.699Z"}, "containers": {"cna": {"title": "Pi loads project-local extensions without approval", "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m"}, {"name": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c"}, {"name": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390"}, {"name": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4"}, {"name": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49"}, {"name": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350"}, {"name": "https://github.com/earendil-works/pi/releases/tag/v0.79.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/releases/tag/v0.79.0"}], "affected": [{"vendor": "earendil-works", "product": "pi", "versions": [{"version": "< 0.79.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:22:55.043Z"}, "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0."}], "source": {"advisory": "GHSA-mqxh-6gq7-558m", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54325", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T19:44:24.627687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T19:44:33.911Z"}}]}}

{"affected": [{"affectedData": [{"product": "pi", "vendor": "earendil-works", "versions": [{"status": "affected", "version": "< 0.79.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0."}, {"lang": "es", "value": "Pi es un arn\u00e9s de codificaci\u00f3n de terminal minimalista. Pi antes de la versi\u00f3n 0.79.0 cargaba la configuraci\u00f3n y los recursos locales del proyecto desde el directorio .pi de un repositorio sin antes pedir al usuario que confiara en ese repositorio. Esto inclu\u00eda extensiones locales del proyecto, que son m\u00f3dulos ejecutables de TypeScript o JavaScript cargados en el proceso de Pi. Un atacante que controla un repositorio podr\u00eda colocar recursos de proyecto espec\u00edficos de Pi en ese repositorio. Si un usuario iniciaba Pi desde ese \u00e1rbol de trabajo, el c\u00f3digo de la extensi\u00f3n local del proyecto podr\u00eda ejecutarse con los mismos privilegios que el proceso local de Pi sin que el usuario tuviera una forma conveniente de tomar una decisi\u00f3n de confianza. Esta vulnerabilidad se corrige en la versi\u00f3n 0.79.0."}], "id": "CVE-2026-54325", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54325", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T19:44:24.627687Z", "version": "2.0.3"}}]}, "published": "2026-06-23T20:16:49.217", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/releases/tag/v0.79.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.79.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pi", "source": "cna", "vendor": "earendil-works"}, "product": "pi", "vendor": "earendil-works"}], "created": "2026-06-23T20:45:06.973667+00:00", "updated": "2026-06-24T16:05:41.057245+00:00", "vendors": ["earendil-works", "earendil-works$PRODUCT$pi"]}