Pi <0.79.0 Unprivileged Arbitrary Code Execution via Project-Local Extensions

Vulnerability Overview Title: Pi loads project-local extensions without approval Description: In versions prior to 0.79.0, Pi loads project-local configurations and resources without requesting user trust. This includes project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository can place Pi-specific resources into that repository. If a user launches Pi from that working tree, the project-local extension code may run with the same privileges as the local Pi process without the user making a trust decision through the usual means. Information: The affected component is Pi's project resource loading path. Prior to 0.79.0, project-local configuration, resources, project package management resources, and project directives were loaded as part of normal project initialization upon startup. Project-local extensions are included in the same extension set as user global extensions and are initialized prior to the project trust boundary. Project-local extensions are not sandboxed like Pi itself. They run within the Pi process and can register commands, tools, and event handlers. The vulnerability behavior does not involve privilege escalation across OS boundaries, but it allows repository-controlled Pi extension code to be implicitly executed when a user runs Pi within that repository. Impact: Exploitation requires user interaction: The attacker must cause the user to open or otherwise work within the controlled repository and launch Pi. If exploited, project-local extension code runs with the same privileges as the user running Pi. It can access files, environment variables, process-available credentials, the network, and local tools available to that user. This issue is rated as low severity because exploitation requires local user action and does not cross privilege boundaries. Remediation: Pi 0.79.0 introduces trust gating for project-local inputs. During interactive startup, Pi now requests a trust decision before loading project-local settings, directives, resources, package management resources, or extensions. Non-interactive modes do not prompt. If no saved trust decision exists, they ignore project-local inputs unless the or flag is passed. Users can pass or to ignore project-local inputs for a single run, even if the project has been previously trusted. Before trust resolution, Pi loads only user global extensions and extensions explicitly passed on the command line. Affected Versions: Affected: Fixed: Solution: Upgrade to version 0.79.0 or higher. After upgrading, carefully review project trust prompts and only trust repositories you are willing to run. For untrusted repositories or unmanaged automation, follow Pi's security guidelines and run Pi within OS sandboxes, containers, VMs, or other isolation boundaries. Workaround: Before and after upgrading, Pi users should only run Pi in trusted repositories or external sandboxes/isolation boundaries. If upgrading is not feasible and the workflow already enforces this trust boundary, continue to avoid running Pi directly in untrusted repositories. Inspect and remove project-local Pi configurations and resources, particularly project-local extensions and package configurations. Disabling extensions and other project resources via command-line flags can reduce exposure, but trusted or isolated execution remains the primary mitigation. Timeline: 2026-05-25: Report received. 2026-06-05: Project trust gating commit. 2026-06-08: Project trust refinement and security model documentation completed. 2026-06-08: Fixed version 0.79.0 released. 2026-06-08: Advisory published. Credits: Reporters: @qerogram, @utanpasu44, @EQSTLab, and @kamalmahbubi References: GHSA-mqgh-6gq7-558m https://github.com/earendil-works/pi/releases/tag/v0.79.0 99a9220 ff3ebef bff18ae 71f2156 e98b724 https://pi.dev/docs/leastsecurity https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/security.md

Goal Reached Thanks to every supporter — we hit 100%!

Pi <0.79.0 Unprivileged Arbitrary Code Execution via Project-Local Extensions

More from this source