CVE-2026-54325

Katalog CVE

CVSS 4.4 · Medium EPSS 0,17%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere. Skor CVSS 3.1 4.4 (Medium) menurut github.com.

Deskripsi (NVD)

Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Deferred

CVSS 3.1

4.4 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c
• https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390
• https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4
• https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49
• https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350
• https://github.com/earendil-works/pi/releases/tag/v0.79.0
• https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m