Urianpaul94

**Name of the Vulnerable Software and Affected Versions** Pi versions prior to 0.79.0 **Description** Pi loaded project-local configuration and resources from a repository's `.pi` directory, including executable TypeScript or JavaScript modules known as project-local extensions, without requiring the user to trust the repository. Because extensions are not sandboxed and run within the Pi process, an attacker controlling a repository could execute arbitrary code with the same privileges as the local Pi process if a user started Pi from that working tree. This allows access to files, environment variables, credentials, the network, and local tools available to the user. The issue resides in the project resource loading path, where `.pi/settings.json`, auto-discovered resources, package-managed resources, and project instruction files were loaded during session initialization before a trust boundary was established. **Recommendations** Update Pi to version 0.79.0 or later. As a temporary workaround, avoid running Pi in untrusted repositories or use an external operating-system sandbox, container, or VM to isolate the execution environment. Inspect and remove project-local Pi configuration and resources, specifically project-local extensions and package configuration, before use in untrusted repositories.

**Name of the Vulnerable Software and Affected Versions** @mariozechner/pi-coding-agent versions 0.28.0 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 **Description** A race condition in the file write path of the credential storage implementation allows the `auth.json` file, which stores API keys and OAuth access and refresh tokens, to be created or rewritten with permissions derived from the process umask before being restricted to owner-only permissions. A local user with read and traverse access to the Pi agent configuration directory could potentially read the file during the interval between the file write and the permission correction. This issue is not remotely exploitable and requires local access to the machine. **Recommendations** Update @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent version 0.78.1 or later. Update @earendil-works/pi-coding-agent to version 0.78.1 or later. Rotate any credentials that may have been exposed on multi-user systems where the configuration directory was readable by other local users. Restrict the Pi agent configuration directory to the owning user, set `auth.json` to owner-only permissions, and run the application with a restrictive umask such as `077` as a temporary workaround.

**Name of the Vulnerable Software and Affected Versions** @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 @mariozechner/pi-coding-agent versions 0.50.0 through 0.73.1 **Description** Pi is a minimal terminal coding harness that used predictable paths under the operating system temporary directory for temporary npm or git extension package installs. On Linux-based multi-user systems with shared temporary directories, a local attacker could pre-create the expected package location. When a victim runs Pi with a temporary extension package source using the `--extension` or `-e` flags, the software may load attacker-controlled extension code in the victim user's process. This occurs because the temporary npm install root and git clone paths were deterministic and rooted under `os.tmpdir()/pi-extensions`. Since extensions execute with the same privileges as the invoking process, this can lead to arbitrary code execution, data loss, or denial of service. This issue primarily affects shared environments like CI runners, HPC login nodes, and shared development machines. **Recommendations** Update @earendil-works/pi-coding-agent to version 0.78.1 or later. Migrate @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent version 0.78.1 or later. As a temporary workaround, avoid using the `--extension` or `-e` flags with npm or git package sources on shared Linux systems. As an additional mitigation, configure the process temporary directory environment to point to a directory owned by the invoking user with `0700` permissions before starting the application.

**Name of the Vulnerable Software and Affected Versions** @mariozechner/pi-coding-agent versions 0.27.5 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 **Description** Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe Markdown link and image URL schemes. In versions implementing scheme filtering, C0 control characters (non-printable characters in the ASCII range 0-31) in the URL scheme can bypass security checks because web browsers normalize these characters before navigation. This can lead to Cross-Site Scripting (XSS), where an attacker could execute scripts in the exported document if they successfully inject unsafe Markdown into a session, such as through prompt injection. The primary risk is the limited disclosure of data embedded within the exported session file. **Recommendations** Update @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent version 0.78.1 or later. Update @earendil-works/pi-coding-agent to version 0.78.1 or later. Regenerate shared HTML exports after upgrading if the underlying sessions contained untrusted content.