low2.2
CVE-2026-54327
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Impact
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @mariozechner/pi-coding-agent | >= 0.28.0, <= 0.73.1 | none recorded |
| npm | @earendil-works/pi-coding-agent | >= 0.74.0, < 0.78.1 | 0.78.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-r95r-rj6r-c39x
- https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
- https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-54327