earendil-works pi

• CVE-2026-54327 Low 2.2 Pi: Race condition in auth.json writes could expose stored credentials <0.1%
• CVE-2026-54326 Low 2.5 Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass 0.2%
• CVE-2026-54328 High 7.3 Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts 0.2%
• CVE-2026-54325 Medium 4.4 Pi loads project-local extensions without approval 0.2%