- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 4 · 1 high, 1 medium, 2 low
- Weekly downloads
- 6M
- Dependents
- 292
- Registry
- npm
Advisories 4
- CVE-2026-54327Low 2.2
Pi: Race condition in auth.json writes could expose stored credentials
Affected: from 0.74.0, fixed in 0.78.1.
- CVE-2026-54326Low 2.5
Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Affected: from 0.74.0, fixed in 0.78.1.
- CVE-2026-54328High 7.3
Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Affected: from 0.74.0, fixed in 0.78.1.
- CVE-2026-54325Medium 4.4
Pi loads project-local extensions without approval
Affected: fixed in 0.79.0.