CVE-2026-54328
unknown
CVSS v3
—
CVSS v4 NEW
—
VIR risk
—
Description
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | @earendil-works/pi-coding-agent | >=0.74.0,<0.78.1 | 0.78.1 |
| npm | @mariozechner/pi-coding-agent | >=0.50.0,<=0.73.1 | |
References
- https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
- https://github.com/earendil-works/pi/pull/5345
- https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
- https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.