Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M
CVE-2026-54327Pi: Race condition in auth.json writes could expose stored credentials
Low 2.2
In plain English
A low-severity incorrect permission assignment in pi from earendil-works. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @earendil-works/pi-coding-agent | 0.78.1 | GHSA-r95r-rj6r-c39x |
| npm | @mariozechner/pi-coding-agent | no fix listed | GHSA-r95r-rj6r-c39x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| earendil-works | pi | >= 0.74.0, < 0.78.1 |
Weakness: CWE-367, CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N