Urianpaul94

Pi loads project-local configuration and resources from a repository's `.pi` directory without requiring user trust. This includes project-local extensions, which are executable TypeScript or JavaScript modules loaded directly into the Pi process. An attacker controlling a repository can place malicious Pi-specific resources within it; if a user starts Pi from that working tree, the extension code executes with the same privileges as the local Pi process. The affected component is the project resource loading path, which previously initialized `.pi/settings.json`, project package-managed resources, and project instruction files during session initialization before a trust boundary was established. Because extensions are not sandboxed, they can register commands, tools, and event handlers, allowing access to files, environment variables, credentials, the network, and local tools available to the user.

A race condition in the file write path of the credential storage implementation allows the `auth.json` file, which stores API keys and OAuth access and refresh tokens, to be created or rewritten with permissions derived from the process umask before being restricted to owner-only permissions. A local user with read and traverse access to the Pi agent configuration directory could potentially read the file during the interval between the file write and the permission correction. This issue is not remotely exploitable and requires local access to the machine.

Pi is a minimal terminal coding harness that used predictable paths under the operating system temporary directory for temporary npm or git extension package installs. On Linux-based multi-user systems with shared temporary directories, a local attacker could pre-create the expected package location. When a victim runs Pi with a temporary extension package source using the `--extension` or `-e` flags, the software may load attacker-controlled extension code in the victim user's process. This occurs because the temporary npm install root and git clone paths were deterministic and rooted under `os.tmpdir()/pi-extensions`. Since extensions execute with the same privileges as the invoking process, this can lead to arbitrary code execution, data loss, or denial of service. This issue primarily affects shared environments like CI runners, HPC login nodes, and shared development machines.

Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe Markdown link and image URL schemes. In versions implementing scheme filtering, C0 control characters (non-printable characters in the ASCII range 0-31) in the URL scheme can bypass security checks because web browsers normalize these characters before navigation. This can lead to Cross-Site Scripting (XSS), where an attacker could execute scripts in the exported document if they successfully inject unsafe Markdown into a session, such as through prompt injection. The primary risk is the limited disclosure of data embedded within the exported session file.