Vulnerability Description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3e
- https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3
- https://github.com/earendil-works/pi/pull/5345
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
- https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
FAQ
What is CVE-2026-54328?
CVE-2026-54328 is a vulnerability with a CVSS score of 7.3 (HIGH). Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary director...
How severe is CVE-2026-54328?
CVE-2026-54328 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54328?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.