CVE-2026-54328
2 advisories.
npm/@earendil-works/pi-coding-agent CVE-2026-54328: high 7.3
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Action: Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later.
npm i @earendil-works/pi-coding-agent@0.78.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.74.0 | 0.78.1 | - |
Fixed versions
| 0.78.1 |
Sources
- osv: GHSA-jfgx-wxx8-mp94
- https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
- https://nvd.nist.gov/vuln/detail/CVE-2026-54328
- https://github.com/earendil-works/pi/pull/5345
- https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
- https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
CVE-2026-54328 · published · modified · JSON
npm/@mariozechner/pi-coding-agent CVE-2026-54328: high 7.3
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.50.0 | - | 0.73.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-jfgx-wxx8-mp94#npm/@mariozechner/pi-coding-agent
- https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
- https://nvd.nist.gov/vuln/detail/CVE-2026-54328
- https://github.com/earendil-works/pi/pull/5345
- https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
- https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
CVE-2026-54328 · published · modified · JSON