CVE-2026-54328

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
https://github.com/earendil-works/pi/pull/5345
https://github.com/earendil-works/pi/releases/tag/v0.78.1
https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Pi es un arnés de codificación de terminal minimalista. Desde la versión 0.74.0 hasta la 0.78.1, las versiones de Pi con instalaciones temporales de paquetes de extensión npm o git utilizaban rutas predecibles bajo el directorio temporal del sistema operativo. En sistemas multiusuario basados en Linux, un atacante local que pudiera escribir en el directorio temporal compartido podría preparar la ubicación esperada del paquete antes de que otro usuario ejecutara pi con una fuente de paquete de extensión temporal. Pi podría entonces cargar código de extensión controlado por el atacante en el proceso del usuario víctima. Esta vulnerabilidad se corrigió en la versión 0.78.1.

Information

Published : 2026-06-23 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54328

Mitre link : CVE-2026-54328

CVE.ORG link : CVE-2026-54328

JSON object : View

Products Affected

No product.

CWE

CWE-379

Creation of Temporary File in Directory with Insecure Permissions

{"id": "CVE-2026-54328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54328", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T13:37:52.524343Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "earendil-works", "product": "pi", "versions": [{"status": "affected", "version": ">= 0.74.0, < 0.78.1"}]}]}], "published": "2026-06-23T20:16:49.603", "references": [{"url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e", "source": "security-advisories@github.com"}, {"url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44", "source": "security-advisories@github.com"}, {"url": "https://github.com/earendil-works/pi/pull/5345", "source": "security-advisories@github.com"}, {"url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-379"}]}], "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1."}, {"lang": "es", "value": "Pi es un arn\u00e9s de codificaci\u00f3n de terminal minimalista. Desde la versi\u00f3n 0.74.0 hasta la 0.78.1, las versiones de Pi con instalaciones temporales de paquetes de extensi\u00f3n npm o git utilizaban rutas predecibles bajo el directorio temporal del sistema operativo. En sistemas multiusuario basados en Linux, un atacante local que pudiera escribir en el directorio temporal compartido podr\u00eda preparar la ubicaci\u00f3n esperada del paquete antes de que otro usuario ejecutara pi con una fuente de paquete de extensi\u00f3n temporal. Pi podr\u00eda entonces cargar c\u00f3digo de extensi\u00f3n controlado por el atacante en el proceso del usuario v\u00edctima. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.78.1."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}