CVE-2026-54325: Pi Agent: Pi loads project-local extensions without approval

Exploitation requires user interaction: the attacker must get a user to open or otherwise work in an attacker-controlled repository and start Pi there. The attacker does not need an account on the user’s machine or prior privileges in Pi.

If exploited, project-local extension code runs with the same permissions as the user running Pi. It can access files, environment variables, credentials available to the process, the network, and local tools available to that user. In CVSS terms, this advisory rates the impact as limited confidentiality and integrity impact without a distinct availability impact because exploitation requires local user action in an untrusted repository and does not cross a privilege boundary.

This risk is most relevant for users who run Pi in repositories they have not reviewed or do not trust. Pi’s security guidance requires users to trust the codebases they work with, or to use an external sandbox or isolation boundary for untrusted repositories.