Skip to content
OpenAdvisories

Package · npm

@earendil-works/pi-coding-agent

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.4
    CVE-2026-54325

    Pi loads project-local extensions without approval

    Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable T…

    earendil-works pi @earendil-works/pi-coding-agent npm