github.com
https://github.com/earendil-works/pi CVE-2026-54328
HIGH
Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Record summary
CVE-2026-54328 has a selected CVSS score of 7.3 (high).
Description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 24, 2026 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | >= 0.74.0, < 0.78.1 | affected | |
@earendil-works/pi-coding-agentBrowse npm / @earendil-works/pi-coding-agent | GitHub Advisory | 0.74.0 to < 0.78.1 · Fixed in 0.78.1 | affected |
@mariozechner/pi-coding-agentBrowse npm / @mariozechner/pi-coding-agent | GitHub Advisory | 0.50.0 to ≤ 0.73.1 | affected |
References
7github.com
https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e github.com
https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44 github.com
https://github.com/earendil-works/pi/pull/5345 github.com
https://github.com/earendil-works/pi/releases/tag/v0.78.1 github.comConfirmation
https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-54328