Local Code Injection in Pi Terminal Coding Harness by Earendil Works

CVE-2026-54328

What is CVE-2026-54328?

The Pi terminal coding harness, versions 0.74.0 to 0.78.1, suffers from a local code injection vulnerability. This occurs due to predictable paths utilized within the operating system's temporary directory when handling npm or git extension package installs. On Linux multi-user systems, an attacker possessing write access to the shared temporary directory may exploit this vulnerability by preparing a malicious package location. If another user subsequently runs Pi, the software could inadvertently load the attacker's code into the victim's process, leading to potential unauthorized actions or system compromise. The issue has been resolved in version 0.78.1.

References