{"id":"EUVD-2026-38580","enisaUuid":"daaace8d-3a94-3601-8d4d-778918923769","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user\u0027s process.  This vulnerability is fixed in 0.78.1.","datePublished":"Jun 23, 2026, 7:25:04 PM","dateUpdated":"Jun 24, 2026, 1:38:04 PM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94\nhttps://github.com/earendil-works/pi/pull/5345\nhttps://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e\nhttps://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","aliases":"CVE-2026-54328\nGHSA-jfgx-wxx8-mp94\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"1cf800be-f579-32a9-85a9-9efb79fbe31b","product":{"name":"pi","vendor":{"name":"earendil-works"}},"product_version":"0.74.0, \u003c 0.78.1"}],"enisaIdVendor":[{"id":"5ce84528-e32d-355f-a91a-78c5bfb235b7","vendor":{"name":"earendil-works"}}],"enisaIdVulnerability":[{"id":"b9a00664-6e69-3057-8fef-8070fb9a5401","vulnerability":{"id":"CVE-2026-54328","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user\u0027s process.  This vulnerability is fixed in 0.78.1.","datePublished":"Jun 23, 2026, 7:25:04 PM","dateUpdated":"Jun 24, 2026, 1:38:04 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94\nhttps://github.com/earendil-works/pi/pull/5345\nhttps://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e\nhttps://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","enisa_id":"EUVD-2026-38580\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Oct 28, 2026, 7:16:10 AM","vulnerabilityProduct":[{"id":"b84f811b-c7e6-3d3d-ba78-fb25ec8edb78","product":{"name":"pi","vendor":{"name":"earendil-works"}},"product_version":"0.74.0, \u003c 0.78.1"}],"vulnerabilityVendor":[{"id":"ccc56fdd-5d5d-3243-99b0-92344c332214","vendor":{"name":"earendil-works"}}]}},{"id":"f6419862-b5aa-35ae-abb5-04eb764cf97b","vulnerability":{"id":"GHSA-jfgx-wxx8-mp94","description":"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","datePublished":"Jun 17, 2026, 1:55:13 PM","dateUpdated":"Jul 20, 2026, 9:13:09 PM","baseScore":0.0,"references":"https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54328\nhttps://github.com/earendil-works/pi/pull/5345\nhttps://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e\nhttps://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44\nhttps://github.com/earendil-works/pi\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","enisa_id":"EUVD-2026-38580\n","aliases":"CVE-2026-54328\nGHSA-jfgx-wxx8-mp94\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}