CVE-2026-54328: Pi Agent: Predictable temporary extension install paths allow local privilege escalation…

📋 Vulnerability Details

🔬 Technical Analysis

Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process.

Info The vulnerable code path affected temporary extension package sources loaded with --extension or -e, specifically npm and git package sources. The temporary npm install root and temporary git clone paths were deterministic and rooted under `os.tmpdir

📚 Advisory References

• https://github.com/advisories/GHSA-jfgx-wxx8-mp94
• https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
• https://github.com/earendil-works/pi/pull/5345
• https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
• https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44

🔗 Related Intelligence

• 📊 CYBERDUDEBIVASH SENTINEL APEX Intelligence Feed
• 🛡️ Detection Rules Marketplace
• 🔌 Threat Intelligence API
• 🏢 Enterprise Advisory
• 📧 Free IOC Pack Download
• 💳 API Pricing & Plans