Description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extension code in the victim user's process. This vulnerability is fixed in 0.78.1.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- earendil-works / pi>= 0.74.0, < 0.78.1 – >= 0.74.0, < 0.78.1
References
- VENDOR_ADVISORYhttps://github.com/earendil-works/pi/security/advisories/GHSA-jfgx-wxx8-mp94
- PATCHhttps://github.com/earendil-works/pi/pull/5345
- PATCHhttps://github.com/earendil-works/pi/commit/a98e087e5d08ea2a536bf73dbb0aebb87c3ef72e
- PATCHhttps://github.com/earendil-works/pi/commit/ea3465a8e371a12d0167a06b60f93878e3a3df44
- PATCHhttps://github.com/earendil-works/pi/releases/tag/v0.78.1