What is the CVSS score of CVE-2026-54327?

CVE-2026-54327 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-54327?

Yes, a patch is available for CVE-2026-54327. Update the affected software to the latest version immediately.

Pi Coding Agent CVE-2026-54327

EUVD-2026-38582 LOW

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-06-17 https://github.com/earendil-works/pi

GHSA-r95r-rj6r-c39x

Crowdstrike Information Disclosure

2.2

CVSS 3.1 · Vendor: https://github.com/earendil-works/pi

Severity by source

Vendor (https://github.com/earendil-works/pi) PRIMARY

2.2 LOW

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

2.2 LOW

Local-only attack vector, High complexity from race timing window, Low privileges for directory traversal, Restricted confidentiality to stored credential file contents only.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/earendil-works/pi).

CVSS VectorVendor: https://github.com/earendil-works/pi

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 14:21 vuln.today

Analysis Generated

Jun 17, 2026 - 14:21 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

31 npm packages depend on @earendil-works/pi-coding-agent (31 direct, 0 indirect)
1 npm packages depend on @mariozechner/pi-coding-agent (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.74.0 and other introduced versions.

DescriptionCVE.org

Pi auth.json writes could briefly expose stored credentials to local users

Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions.

Info

The affected credential storage code wrote auth.json and then corrected the file mode in a separate operation. During the interval between those operations, a local user who could read and traverse the Pi agent configuration directory could potentially read the file before its permissions were restricted.

The file can contain API keys, OAuth access tokens, and OAuth refresh tokens for configured providers. The affected behavior was present in the original auth.json credential storage implementation and thus affects both the original @mariozechner/pi-coding-agent package as well as @earendil-works/pi-coding-agent.

Impact

Exploitation requires local access to the same machine and read/traverse access to the victim's Pi agent configuration directory. Users whose ~/.pi/agent directory is private to their account are less exposed. The main impact is disclosure of stored provider credentials, which may allow use of the configured provider accounts according to the privileges of those credentials.

This is not remotely exploitable by itself.

Affected versions

Affected: @mariozechner/pi-coding-agent >= 0.28.0, <= 0.73.1
Affected: @earendil-works/pi-coding-agent >= 0.74.0, < 0.78.1
Patched: @earendil-works/pi-coding-agent >= 0.78.1

The solution

Version 0.78.1 changed the credential storage writes to create auth.json with mode 0600 at open time. The fix applies to initial file creation and credential save paths, including OAuth token refresh writes.

Recommendations

Upgrade to @earendil-works/pi-coding-agent version 0.78.1 or later. Users still on the deprecated @mariozechner/pi-coding-agent package should migrate to the @earendil-works/pi-coding-agent package and install version 0.78.1 or later.

After upgrading, rotate any credentials that may have been exposed on multi-user systems where the Pi agent configuration directory was readable by other local users.

Workarounds

If upgrading immediately is not possible, restrict the Pi agent configuration directory so only the owning user can traverse it, restrict auth.json to owner-only permissions, and run Pi with a restrictive umask such as 077 until the upgrade is complete.

Timeline

2026-05-29: Report received
2026-06-02: Fix committed
2026-06-04: Fixed version released
2026-06-08: Advisory published

Credits

Reported by Paul Urian and Cosmin Alexa of CrowdStrike.

AnalysisAI

Credential disclosure in Pi coding agent affects all versions of @mariozechner/pi-coding-agent (>=0.28.0, <=0.73.1) and @earendil-works/pi-coding-agent (>=0.74.0, <0.78.1) due to a TOCTOU race condition in auth.json file writes. The credential storage code wrote auth.json with umask-inherited permissions and only subsequently tightened the mode to owner-only, leaving a brief window in which a local user with directory traverse access could read API keys, OAuth access tokens, and OAuth refresh tokens. This is not remotely exploitable; no public exploit identified at time of analysis, and the vendor CVSS of 2.2 reflects the strict local and timing prerequisites.

Technical ContextAI

The root cause is CWE-367 (Time-of-Check Time-of-Use race condition) in the credential storage backend of the Pi coding agent, implemented in packages/coding-agent/src/core/auth-storage.ts. The affected code called Node.js writeFileSync without specifying a file creation mode, causing auth.json to inherit permissions from the process umask - potentially world-readable - before a separate chmod-equivalent operation corrected it to 0600. The fix introduced a shared constant AUTH_FILE_WRITE_OPTIONS = { encoding: 'utf-8', mode: 0o600 } applied atomically at open time across all three writeFileSync call sites, eliminating the race window entirely. Both affected npm packages (pkg:npm/@mariozechner_pi-coding-agent and pkg:npm/@earendil-works_pi-coding-agent) share the same vulnerable code lineage, as the latter is a continuation of the former from version 0.74.0 onward.

RemediationAI

Vendor-released patch: @earendil-works/pi-coding-agent 0.78.1. Upgrade to @earendil-works/pi-coding-agent version 0.78.1 or later via npm; this release atomically creates auth.json with mode 0600 at open time, eliminating the race window. Users still on the deprecated @mariozechner/pi-coding-agent package must migrate entirely to @earendil-works/pi-coding-agent and install 0.78.1 or later, as no patch will be issued for the legacy package. After upgrading on any multi-user system where ~/.pi/agent was readable by other local users, rotate all configured provider API keys and OAuth tokens immediately, as prior credential exposure cannot be ruled out. If immediate upgrade is not possible, apply three interim controls: restrict the ~/.pi/agent directory to owner-only permissions (chmod 700 ~/.pi/agent) to prevent directory traversal by other local users; manually restrict auth.json to mode 0600 (chmod 600 ~/.pi/agent/auth.json); and launch Pi with a restrictive umask (umask 077) to reduce the creation-mode window. Note that the umask workaround is non-atomic and does not fully close the race - directory restriction is the most effective compensating control. Advisory: https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x.