pi-coding-agent Local Privilege Escalation via Predictable Temp Paths (CVE-2020-54328)

Vulnerability Overview Title: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts Description: Pi versions use temporary npm or git extension package installations, which rely on predictable paths within the OS temporary directory. On multi-user Linux systems, a local attacker can write to the shared temporary directory to pre-populate the expected extension package location, then load attacker-controlled extension code when another user runs . Impact: A local attacker can exploit this vulnerability to execute arbitrary extension code via temporary npm or git extension package sources when a victim is running a vulnerable version of . Successful exploitation allows arbitrary extension code to be executed under the victim user's identity, potentially exposing or modifying files, leading to service disruption or data loss. Scope of Impact Affected Versions: : >= 0.74.0, = 0.50.0, < 0.73.1 Primary Impact: Linux multi-user hosts where the OS temporary directory is shared across users. Environments such as shared development machines, CI runners, and HPC login nodes. Windows and macOS are not affected by default, unless the temporary directory is overridden to be a shared writable location. Remediation Solution: Upgrade to version 0.78.1 or later. Users of should migrate to the package and upgrade to the fixed version. Recommendations: On shared Linux hosts, avoid using temporary npm or git extension package sources with vulnerable versions. Review the behavior of any third-party extensions before loading to ensure that extensions operate with full access to the caller user's account. Temporary Workarounds: If immediate upgrade is not possible, avoid using or with npm or git package sources. Configure the process's temporary directory environment variable to point to a directory owned by the calling user with permissions set to 0700. Timeline 2020-05-29: Report received 2020-06-02: Fix committed 2020-06-04: Fixed version 0.78.1 released 2020-06-08: Advisory preparation finalized References GHSA-j9xg-xxw8-mp94 e5345 aa465a a9e8d87 v0.78.1 v0.50.0 v0.74.0 Credits Reporters: Paul Urian and Cosmin Alexa (CrowdStrike) Additional Information CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2020-54328 Weakness: CWE-378 Reporter: utapanu84

Goal Reached Thanks to every supporter — we hit 100%!

pi-coding-agent Local Privilege Escalation via Predictable Temp Paths (CVE-2020-54328)

More from this source