The vulnerability identified as CVE-2026-54325 in earendil-works pi involves the inclusion of functionality from an untrusted control sphere (CWE-829). Versions of Pi prior to 0.79.0 load project-local configuration and executable extensions from a repository's .pi directory without prompting the user to trust the repository. This behavior allows an attacker who controls a repository to place malicious Pi-specific project resources that execute with the same privileges as the Pi process when started in that repository's working tree. This can lead to unauthorized code execution within the user's environment. The issue is resolved in version 0.79.0.

An attacker controlling a repository can execute arbitrary TypeScript or JavaScript code with the privileges of the Pi process when a user runs Pi in that repository. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). There is no indication of availability impact or known exploits in the wild.

Upgrade to Pi version 0.79.0 or later, where this vulnerability is fixed by requiring user trust before loading project-local extensions. Since no official patch link or vendor advisory is provided, users should verify the version before use. Patch status is not yet confirmed by a vendor advisory; check for official updates.