{"id":"CVE-2026-54328","revision":null,"records":[{"revision":"96b15b58e7e94e1db739a516d64890dd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54328","aliases":[],"title":"Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.  This vulnerability is fixed in 0.78.1.","state":0,"publishedAt":"2026-06-23T19:25:04.051+00:00","modifiedAt":"2026-06-24T13:38:04.242+00:00","affected":[{"ecosystem":"Vendor product","name":"pi","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"earendil-works\",\n                    \"product\": \"pi\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.74.0, < 0.78.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3,"severity":"HIGH"}],"references":["https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94","https://github.com/earendil-works/pi/pull/5345","https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e","https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44","https://github.com/earendil-works/pi/releases/tag/v0.78.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54328","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54328","identifiers":["CVE-2026-54328"]},"retained":false,"historicalAffected":[]},{"revision":"2a8699a5938f4750bddb5196f1fb1fda","observedAt":"2026-11-07T12:29:41.217+00:00","statement":{"source":"euvd","id":"EUVD-2026-38580","aliases":["CVE-2026-54328","GHSA-jfgx-wxx8-mp94"],"title":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a …","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.  This vulnerability is fixed in 0.78.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3,"severity":null}],"references":["https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94","https://github.com/earendil-works/pi/pull/5345","https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e","https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44","https://github.com/earendil-works/pi/releases/tag/v0.78.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38580","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 23, 2026, 7:25:04 PM","dateUpdated":"Jun 24, 2026, 1:38:04 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38580","identifiers":["EUVD-2026-38580","CVE-2026-54328","GHSA-jfgx-wxx8-mp94"]},"retained":false,"historicalAffected":[]},{"revision":"cb5a24bd07b24c2baf257cc6306b91ee","observedAt":"2026-10-27T14:13:32.924+00:00","statement":{"source":"nvd","id":"CVE-2026-54328","aliases":[],"title":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a …","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.  This vulnerability is fixed in 0.78.1.","state":0,"publishedAt":"2026-06-23T20:16:49.603+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3,"severity":"HIGH"}],"references":["https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e","https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44","https://github.com/earendil-works/pi/pull/5345","https://github.com/earendil-works/pi/releases/tag/v0.78.1","https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54328","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-379"],"productCriteria":[],"sourceDates":{"published":"2026-06-23T20:16:49.603","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54328","identifiers":["CVE-2026-54328"]},"retained":false,"historicalAffected":[]},{"revision":"a624dca447424f9fbf1e28b9f1585c0a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-jfgx-wxx8-mp94","aliases":["CVE-2026-54328"],"title":"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","description":"# Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts\n\nPi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.\n\n## Info\n\nThe vulnerable code path affected temporary extension package sources loaded with `--extension` or `-e`, specifically npm and git package sources. The temporary npm install root and temporary git clone paths were deterministic and rooted under `os.tmpdir()/pi-extensions`. The path was derived from public source information rather than from a per-user private directory or an unpredictable temporary directory.\n\nDuring resource resolution, pi considered an npm package or git checkout present if the expected package path already existed. Extension resources discovered from that package location were then loaded by the extension loader. Because extensions execute with the same privileges as the invoking pi process, pre-created temporary package contents could execute as the victim user.\n\nThe issue primarily affects Linux-based multi-user hosts where the operating system temporary directory is shared across user accounts, such as shared development machines, CI runners, HPC login nodes, and similar environments. On Windows and macOS, the default temporary directory is typically user-scoped, so default configurations are not expected to be affected unless the temporary directory is overridden to a shared writable location.\n\n## Impact\n\nA local attacker with access to the same host can exploit this only if a victim runs a vulnerable pi version with a temporary npm or git extension package source that maps to the attacker-prepared location. No network attack path is involved and no race must be won, but victim interaction is required.\n\nSuccessful exploitation can allow arbitrary extension code execution as the victim user. This can expose or modify files accessible to that user and can also cause denial of service or data loss through malicious package contents or unsafe temporary cache entries.\n\n## Affected versions\n\n- `@earendil-works/pi-coding-agent`: affected `>= 0.74.0, < 0.78.1`; patched `>= 0.78.1`\n- `@mariozechner/pi-coding-agent`: affected `>= 0.50.0, <= 0.73.1`; no patched version was released under the old package name. Migrate to `@earendil-works/pi-coding-agent >= 0.78.1`.\n\n## The solution\n\nVersion 0.78.1 moves temporary extension package installs to a private per-user directory under `~/.pi/agent/tmp/extensions` and enforces `0700` permissions on that directory. The same release also hardens git package source path handling so managed clone paths remain inside their intended install roots.\n\n## Recommendations\n\nUpgrade to `@earendil-works/pi-coding-agent` version 0.78.1 or later. Users of the deprecated `@mariozechner/pi-coding-agent` package should migrate to the `@earendil-works/pi-coding-agent` package and upgrade to a fixed version.\n\nOn shared Linux hosts, avoid using temporary npm or git extension package sources with vulnerable versions. Review any third-party extensions before loading them, because pi extensions run with full access to the invoking user's account.\n\n## Workarounds\n\nIf upgrading immediately is not possible, avoid `--extension` or `-e` with npm or git package sources on shared Linux systems. As an additional mitigation for vulnerable versions, configure the process temporary directory environment to point at a directory owned by the invoking user with `0700` permissions before starting pi.\n\n## Timeline\n\n- 2026-05-29: Report received\n- 2026-06-02: Fix committed\n- 2026-06-04: Fixed version 0.78.1 released\n- 2026-06-08: Advisory prepared for publication\n\n## Credits\n\nReported by Paul Urian and Cosmin Alexa of CrowdStrike.","state":0,"publishedAt":"2026-06-17T13:55:13+00:00","modifiedAt":"2026-07-20T21:30:40.2713683+00:00","affected":[{"ecosystem":"npm","name":"@earendil-works/pi-coding-agent","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.74.0"},{"kind":"fixed","version":"0.78.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@mariozechner/pi-coding-agent","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.50.0"},{"kind":"last_affected","version":"0.73.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94","https://nvd.nist.gov/vuln/detail/CVE-2026-54328","https://github.com/earendil-works/pi/pull/5345","https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e","https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44","https://github.com/earendil-works/pi","https://github.com/earendil-works/pi/releases/tag/v0.78.1"],"sourceUrl":"https://github.com/advisories/GHSA-jfgx-wxx8-mp94","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jfgx-wxx8-mp94","identifiers":["GHSA-jfgx-wxx8-mp94","CVE-2026-54328"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.014368+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.014369+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-aac6631b84e101279eb6b1c3835f52bf7b26c50f4d25bc0fb35977235593f4a7","complete":true,"records":420943,"lastAttemptAt":"2026-11-07T20:07:23.1739993+00:00","lastSuccessAt":"2026-11-07T20:07:23.0712879+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.1739993+00:00","snapshotPublishedAt":"2026-11-07T19:18:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c5a2504558b549559b8658a653596391","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T20:19:26.3099435+00:00","lastSuccessAt":"2026-11-07T20:19:26.304+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:19:26.304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.0152025+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.0152028+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-191690d52ba04a91b1a2749fa6191ceb","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:07:42.8841875+00:00","lastSuccessAt":"2026-11-07T20:07:42.881+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:42.881+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:07:23.800032+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.800032+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:07:23.2420378+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.2420378+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:07:23.8227715+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.8227715+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:07:23.4659623+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.4659623+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}