Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Date: 2026-06
Affected: npm/@mariozechner/pi-coding-agent, npm/@earendil-works/pi-coding-agent
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-54328
CWE: CWE-379
CVSS: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

# Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. ## Info The vulnerable code path affected temporary extension package sources loaded with `--extension` or `-e`, specifically npm and git package sources. The temporary npm install root and temporary git clone paths were deterministic and rooted under `os.tmpdir()/pi-extensions`. The path was derived from public source information rather than from a per-user private directory or an unpredictable temporary directory. During resource resolution, pi considered an npm package or git checkout present if the expected package path already existed. Extension resources discovered from that package location were then loaded by the extension loader. Because extensions execute with the same privileges as the invoking pi process, pre-created temporary package contents could execute as the victim user. The issue primarily affects Linux-based multi-user hosts where the operating system temporary directory is shared across user accounts, such as shared develo


Mitigations:

Architectural layers (MAESTRO):