CVE-2026-54328

{
  "id": "CVE-2026-54328",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T20:16:49.603",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.  This vulnerability is fixed in 0.78.1."
    },
    {
      "lang": "es",
      "value": "Pi es un arnés de codificación de terminal minimalista. Desde la versión 0.74.0 hasta la 0.78.1, las versiones de Pi con instalaciones temporales de paquetes de extensión npm o git utilizaban rutas predecibles bajo el directorio temporal del sistema operativo. En sistemas multiusuario basados en Linux, un atacante local que pudiera escribir en el directorio temporal compartido podría preparar la ubicación esperada del paquete antes de que otro usuario ejecutara pi con una fuente de paquete de extensión temporal. Pi podría entonces cargar código de extensión controlado por el atacante en el proceso del usuario víctima. Esta vulnerabilidad se corrigió en la versión 0.78.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "earendil-works",
          "product": "pi",
          "versions": [
            {
              "version": ">= 0.74.0, < 0.78.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T13:37:52.524343Z",
          "id": "CVE-2026-54328",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-379"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/earendil-works/pi/pull/5345",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94",
      "source": "[email protected]"
    }
  ]
}