earendil-works/pi Security Advisories | GitStock

medium2026-06-17

CVE-2026-54325-Pi Agent: Pi loads project-local extensions without approval

GHSA-mqxh-6gq7-558m

high2026-06-17

CVE-2026-54328-Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts

GHSA-jfgx-wxx8-mp94

low2026-06-17

CVE-2026-54327-Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

GHSA-r95r-rj6r-c39x

low2026-06-16

CVE-2026-54326-Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

GHSA-7v5m-pr3q-6453