CVE-2026-54328
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
Pi is a minimal terminal coding harness. From versions 0.74.0 to 0.78.1, temporary npm or git extension package installs used predictable paths under the operating system's temporary directory, allowing a local attacker to inject malicious code.
Risk Assessment
On Linux-based multi-user systems, an attacker can prepare the package location before another user runs Pi, leading to the loading of attacker-controlled code in the victim's process.
Recommendation
It is recommended to upgrade to version 0.78.1, where this vulnerability has been fixed, to minimize the risk of attack.
Original NVD description (English source)
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.