CVE-2026-54328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54328", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T18:42:02.224Z", "datePublished": "2026-06-23T19:25:04.051Z", "dateUpdated": "2026-06-24T13:38:04.242Z"}, "containers": {"cna": {"title": "Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts", "problemTypes": [{"descriptions": [{"cweId": "CWE-379", "lang": "en", "description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94"}, {"name": "https://github.com/earendil-works/pi/pull/5345", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/pull/5345"}, {"name": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e"}, {"name": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44"}, {"name": "https://github.com/earendil-works/pi/releases/tag/v0.78.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1"}], "affected": [{"vendor": "earendil-works", "product": "pi", "versions": [{"version": ">= 0.74.0, < 0.78.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:25:04.051Z"}, "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1."}], "source": {"advisory": "GHSA-jfgx-wxx8-mp94", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-24T13:37:52.524343Z", "id": "CVE-2026-54328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:38:04.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T13:37:52.524343Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:37:56.654Z"}}], "cna": {"title": "Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts", "source": {"advisory": "GHSA-jfgx-wxx8-mp94", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "earendil-works", "product": "pi", "versions": [{"status": "affected", "version": ">= 0.74.0, < 0.78.1"}]}], "references": [{"url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94", "name": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/earendil-works/pi/pull/5345", "name": "https://github.com/earendil-works/pi/pull/5345", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e", "name": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44", "name": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1", "name": "https://github.com/earendil-works/pi/releases/tag/v0.78.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-379", "description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:25:04.051Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54328", "state": "PUBLISHED", "dateUpdated": "2026-06-24T13:38:04.242Z", "dateReserved": "2026-06-12T18:42:02.224Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T19:25:04.051Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pi", "vendor": "earendil-works", "versions": [{"status": "affected", "version": ">= 0.74.0, < 0.78.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1."}, {"lang": "es", "value": "Pi es un arn\u00e9s de codificaci\u00f3n de terminal minimalista. Desde la versi\u00f3n 0.74.0 hasta la 0.78.1, las versiones de Pi con instalaciones temporales de paquetes de extensi\u00f3n npm o git utilizaban rutas predecibles bajo el directorio temporal del sistema operativo. En sistemas multiusuario basados en Linux, un atacante local que pudiera escribir en el directorio temporal compartido podr\u00eda preparar la ubicaci\u00f3n esperada del paquete antes de que otro usuario ejecutara pi con una fuente de paquete de extensi\u00f3n temporal. Pi podr\u00eda entonces cargar c\u00f3digo de extensi\u00f3n controlado por el atacante en el proceso del usuario v\u00edctima. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.78.1."}], "id": "CVE-2026-54328", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54328", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-24T13:37:52.524343Z", "version": "2.0.3"}}]}, "published": "2026-06-23T20:16:49.603", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/pull/5345"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-379"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.74.0,0.78.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pi", "source": "cna", "vendor": "earendil-works"}, "product": "pi", "vendor": "earendil-works"}], "created": "2026-06-23T20:45:06.973516+00:00", "updated": "2026-06-24T16:05:39.360657+00:00", "vendors": ["earendil-works", "earendil-works$PRODUCT$pi"]}