zosmaai

A critical vulnerability, CVE-2026-102911, has been disclosed in zosmaai's pi-llm-wiki software, versions 0.11.0 through 0.11.7. The flaw is an OS command injection in mcp/index.ts that could allow remote code execution, and a public exploit is already available. Users are urged to upgrade to version 0.11.8 immediately. Security researchers are sharing the advisory and stressing the urgency given the public exploit code.