CVE-2026-54328 is a CWE-379 vulnerability affecting earendil-works pi versions from 0.74.0 until 0.78.1. The vulnerability arises because Pi uses predictable temporary file paths for npm or git extension package installs under the operating system's temporary directory. On Linux multi-user systems, a local attacker with write permissions to the shared temporary directory can preemptively create files at these predictable locations. When another user runs Pi with a temporary extension package source, Pi may load the attacker-controlled extension code, leading to code execution within the victim user's process. The vulnerability is resolved in version 0.78.1.

Successful exploitation allows a local attacker with write access to the shared temporary directory to execute arbitrary code in the context of another user running Pi with temporary extension packages. This can lead to full compromise of the victim user's process, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.3 (high).

This vulnerability is fixed in Pi version 0.78.1. Users should upgrade to version 0.78.1 or later to remediate this issue. Patch status is not explicitly confirmed beyond this fix version, so users should verify with the vendor advisory for the latest remediation guidance.