Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by earendil-works

    CVE-2026-54327 (GCVE-0-2026-54327)

    Vulnerability from cvelistv5 – Published: 2026-06-23 19:28 – Updated: 2026-06-23 19:28
    VLAI
    Title
    Pi: Race condition in auth.json writes could expose stored credentials
    Summary
    Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.
    Severity
    2.2 (Low)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    References
    Impacted products
    Vendor Product Version
    earendil-works pi Affected: >= 0.74.0, < 0.78.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pi",
          "vendor": "earendil-works",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.74.0, \u003c 0.78.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T19:28:22.503Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347"
        },
        {
          "name": "https://github.com/earendil-works/pi/releases/tag/v0.78.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r95r-rj6r-c39x",
        "discovery": "UNKNOWN"
      },
      "title": "Pi: Race condition in auth.json writes could expose stored credentials"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54327",
    "datePublished": "2026-06-23T19:28:22.503Z",
    "dateReserved": "2026-06-12T18:42:02.224Z",
    "dateUpdated": "2026-06-23T19:28:22.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54326 (GCVE-0-2026-54326)

    Vulnerability from cvelistv5 – Published: 2026-06-23 19:26 – Updated: 2026-06-24 13:09
    VLAI
    Title
    Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
    Summary
    Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.
    Severity
    2.5 (Low)
    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    earendil-works pi Affected: >= 0.74.0, < 0.78.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T13:09:02.637895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T13:09:14.395Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pi",
          "vendor": "earendil-works",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.74.0, \u003c 0.78.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T19:26:35.875Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010"
        },
        {
          "name": "https://github.com/earendil-works/pi/releases/tag/v0.78.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7v5m-pr3q-6453",
        "discovery": "UNKNOWN"
      },
      "title": "Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54326",
    "datePublished": "2026-06-23T19:26:35.875Z",
    "dateReserved": "2026-06-12T18:42:02.224Z",
    "dateUpdated": "2026-06-24T13:09:14.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54328 (GCVE-0-2026-54328)

    Vulnerability from cvelistv5 – Published: 2026-06-23 19:25 – Updated: 2026-06-24 13:38
    VLAI
    Title
    Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
    Summary
    Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-379 - Creation of Temporary File in Directory with Insecure Permissions
    Assigner
    References
    Impacted products
    Vendor Product Version
    earendil-works pi Affected: >= 0.74.0, < 0.78.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T13:37:52.524343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T13:38:04.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pi",
          "vendor": "earendil-works",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.74.0, \u003c 0.78.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user\u0027s process.  This vulnerability is fixed in 0.78.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T19:25:04.051Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94"
        },
        {
          "name": "https://github.com/earendil-works/pi/pull/5345",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/pull/5345"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44"
        },
        {
          "name": "https://github.com/earendil-works/pi/releases/tag/v0.78.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/releases/tag/v0.78.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jfgx-wxx8-mp94",
        "discovery": "UNKNOWN"
      },
      "title": "Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54328",
    "datePublished": "2026-06-23T19:25:04.051Z",
    "dateReserved": "2026-06-12T18:42:02.224Z",
    "dateUpdated": "2026-06-24T13:38:04.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54325 (GCVE-0-2026-54325)

    Vulnerability from cvelistv5 – Published: 2026-06-23 19:22 – Updated: 2026-06-23 19:44
    VLAI
    Title
    Pi loads project-local extensions without approval
    Summary
    Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0.
    Severity
    4.4 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    References
    Impacted products
    Vendor Product Version
    earendil-works pi Affected: < 0.79.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54325",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T19:44:24.627687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T19:44:45.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pi",
          "vendor": "earendil-works",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.79.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository\u0027s .pi directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-local extension code could run with the same privileges as the local Pi process without the user having a convenient way to make a trust decision. This vulnerability is fixed in 0.79.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T19:22:55.043Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/earendil-works/pi/security/advisories/GHSA-mqxh-6gq7-558m"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/38f18be44727e669eb0a6e2eb8edb51b0232d83c"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/718215bd95b6fc6fa251580d27ea8aab857de390"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/89a92207f1c9303d53d822fd9b0ac21578834cb4"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/ce3a72444e1cc1eaa50475fb3378c7ffbb53ef49"
        },
        {
          "name": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/commit/ff3e9df5f5b32368c20b0ef553a6834b3dee9350"
        },
        {
          "name": "https://github.com/earendil-works/pi/releases/tag/v0.79.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/earendil-works/pi/releases/tag/v0.79.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mqxh-6gq7-558m",
        "discovery": "UNKNOWN"
      },
      "title": "Pi loads project-local extensions without approval"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54325",
    "datePublished": "2026-06-23T19:22:55.043Z",
    "dateReserved": "2026-06-12T18:42:02.224Z",
    "dateUpdated": "2026-06-23T19:44:45.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}