CVE-2026-54328: Pi Terminal Privilege Escalation Flaw

CVE-2026-54328 Overview

CVE-2026-54328 is a local privilege escalation vulnerability in Pi, a minimal terminal coding harness developed by earendil-works. Versions 0.74.0 through 0.78.0 use predictable paths under the operating system temporary directory when installing temporary npm or git extension packages. On Linux multi-user systems, a local attacker with write access to the shared temporary directory can pre-stage the expected package location. When a victim user subsequently runs pi with a temporary extension package source, Pi loads attacker-controlled extension code in the victim's process. The issue is tracked as [CWE-379: Creation of Temporary File in Directory with Insecure Permissions] and fixed in version 0.78.1.

Critical Impact
A local attacker on a shared Linux host can achieve arbitrary code execution in another user's pi process, leading to full compromise of that user's session and accessible resources.

Affected Products

Pi coding harness versions 0.74.0 through 0.78.0
Linux-based multi-user systems running Pi with temporary extension packages
Pi installations using npm or git extension package sources in temporary scope

Discovery Timeline

2026-06-23 - CVE-2026-54328 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54328

Vulnerability Analysis

The vulnerability stems from Pi's package manager using deterministic, predictable paths under the shared system temporary directory (typically /tmp) when installing temporary extension packages. On Linux, /tmp is world-writable by default. Any local user can create files or directories matching paths that another user's pi invocation will later read from or execute.

The defect resides in the coding agent's package manager logic in packages/coding-agent/src/core/package-manager.ts. The original implementation constructed install paths using tmpdir() combined with attacker-influenced source identifiers, without restricting permissions or validating that path components were safe.

When pi resolves a temporary git or npm extension, it expects the package to be staged at a path derived from the source host and path. An attacker who predicts this path can place malicious extension code at that location before the victim runs pi. Pi then loads and executes the planted code inside the victim user's process.

Root Cause

Two design flaws combine to create the issue. First, the temporary extension cache lived inside the shared OS temporary directory rather than a per-user, permission-restricted location. Second, path components derived from source.host and source.path were not validated against traversal sequences, URL-encoded payloads, backslashes, or absolute-path prefixes, allowing an attacker to influence the final install location.

Attack Vector

Exploitation requires local access to a multi-user Linux system and the ability to write to the shared temporary directory. The attacker enumerates or predicts the deterministic path Pi would use for a given extension source, then writes attacker-controlled JavaScript or TypeScript extension code at that location. When the victim runs pi with a matching temporary extension package source, Pi loads the planted code with the victim's privileges. User interaction is required because the victim must invoke pi with the matching extension reference.

typescript

// Patch excerpt: packages/coding-agent/src/core/package-manager.ts
 if (scope === "temporary") {
   return this.getTemporaryDir(`git-${source.host}`, source.path);
 }
-if (scope === "project") {
-  return join(this.cwd, CONFIG_DIR_NAME, "git", source.host, source.path);
+const installRoot = this.getGitInstallRoot(scope);
+if (!installRoot) {
+  throw new Error("Missing git install root");
 }
-return join(this.agentDir, "git", source.host, source.path);
+return this.resolveManagedPath(installRoot, source.host, source.path);

// Patch excerpt: packages/coding-agent/src/utils/git.ts
+function hasUnsafeGitInstallPart(value: string, allowSlash: boolean): boolean {
+  const decoded = decodeForValidation(value);
+  if (decoded === null) return true;
+  const candidates = [value, decoded];
+  for (const candidate of candidates) {
+    if (candidate.includes("\0") || candidate.includes("\\") || candidate.startsWith("/")) return true;
+    if (!allowSlash && candidate.includes("/")) return true;
+    if (candidate.split("/").includes("..")) return true;
+  }
+  return false;
+}

Source: GitHub Commit a98e087

Detection Methods for CVE-2026-54328

Indicators of Compromise

Unexpected files or directories under /tmp matching Pi's package cache naming pattern (e.g., paths containing git-<host> or npm package identifiers) created by users other than the running Pi user.
Unknown extension code loaded by pi processes, visible through child process spawns or outbound network connections from node processes invoked by Pi.
File ownership mismatches where Pi extension files in temporary directories are owned by a different UID than the user running pi.

Detection Strategies

Monitor file creation events in /tmp for paths matching Pi's deterministic package layout, correlating creator UID against the user running pi.
Audit execve and node child-process telemetry from pi invocations to detect loading of extension modules from world-writable directories.
Inventory installed versions of Pi across endpoints and flag any installation below 0.78.1.

Monitoring Recommendations

Enable Linux audit rules (auditd) on /tmp write operations from non-root users on shared developer hosts.
Alert on pi process invocations referencing temporary-scope extension sources, especially on multi-user systems.
Track package-manager log output for unexpected reuse of pre-existing cache directories on first install.

How to Mitigate CVE-2026-54328

Immediate Actions Required

Upgrade Pi to version 0.78.1 or later on all systems, prioritizing shared Linux developer hosts.
Audit /tmp on multi-user systems for pre-staged Pi extension directories and remove any not owned by current Pi users.
Restrict use of temporary-scope extension package sources until all Pi installations are patched.

Patch Information

The fix is delivered in Pi v0.78.1. Two commits implement the remediation: commit a98e087 hardens git package install paths with strict validation of host and path components, and commit ea3465a (via PR #5345) moves the temporary extension cache out of the shared OS temporary directory and applies restrictive permissions with chmodSync. Full details are available in GHSA-jfgx-wxx8-mp94.

Workarounds

Avoid running pi with temporary npm or git extension package sources on systems where untrusted users have write access to /tmp.
Set the TMPDIR environment variable to a private, mode 0700 directory owned by the running user before invoking pi.
Mount /tmp with per-user namespaces (e.g., pam_namespace polyinstantiation) on shared Linux hosts to prevent cross-user staging.

bash

# Per-user private temporary directory for Pi invocations
mkdir -p "$HOME/.pi-tmp"
chmod 700 "$HOME/.pi-tmp"
export TMPDIR="$HOME/.pi-tmp"

# Verify installed Pi version
pi --version    # must report 0.78.1 or later

# Upgrade via npm (example)
npm install -g pi@latest