Low severity2.2NVD Advisory· Published Jun 23, 2026· Updated Jun 26, 2026
CVE-2026-54327
CVE-2026-54327
Description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@mariozechner/pi-coding-agentnpm | >= 0.28.0, <= 0.73.1 | — |
@earendil-works/pi-coding-agentnpm | >= 0.74.0, < 0.78.1 | 0.78.1 |
Affected products
1- Range: 0.74.0 - 0.78.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-r95r-rj6r-c39xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-54327ghsaADVISORY
- github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347nvdWEB
- github.com/earendil-works/pi/releases/tag/v0.78.1nvdWEB
- github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39xnvdWEB
News mentions
0No linked articles in our index yet.