CVE-2026-54328

Katalog CVE

CVSS 7.3 · High EPSS 0,16%

Kerentanan Creation of Temporary File in Directory with Insecure Permissions. Skor CVSS 3.1 7.3 (High) menurut github.com.

Deskripsi (NVD)

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.3 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
• https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
• https://github.com/earendil-works/pi/pull/5345
• https://github.com/earendil-works/pi/releases/tag/v0.78.1
• https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94