CVE-2026-54328
CVE-2026-54328 · Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.
CVSS 7.3 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
pi
- Versions
- >= 0.74.0, < 0.78.1: Affected
No fix published
@earendil-works/pi-coding-agent npm
- Affected ranges
- SEMVER: ≥ 0.74.0, < 0.78.1
Update to 0.78.1
@mariozechner/pi-coding-agent npm
- Affected ranges
- SEMVER: ≥ 0.50.0, ≤ 0.73.1
No fix published
Original sources
- https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
- https://github.com/earendil-works/pi/pull/5345
- https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
- https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-54328