Pi Coding Agent CVE-2026-54327

All of the following conditions must hold simultaneously: (1) the attacker has a local shell account on the same machine as the victim; (2) the victim's Pi agent configuration directory (~/.pi/agent or equivalent) is traversable by the attacker - i.e., not restricted to owner-only permissions; (3) the attacker successfully times a file read to the brief window between auth.json creation and the permission-tightening operation, classified AC:H in the CVSS vector; and (4) the victim must trigger a credential write during the attack window (UI:R) - this occurs on initial auth setup, credential saves, or OAuth token refresh. The vulnerability is explicitly not remotely exploitable by itself (AV:L). Users whose home directory or ~/.pi/agent directory is private (mode 700 or stricter) are substantially protected, as the attacker cannot traverse the directory to reach auth.json. The @mariozechner/pi-coding-agent package has no fix available, making migration the only complete remediation for those users.

The vendor CVSS 3.1 score of 2.2 (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) is independently validated and accurately reflects real-world risk. Attack vector is strictly local, complexity is High due to race timing requirements, the attacker needs at minimum low-privilege shell access plus directory traverse rights, and user interaction is required because the victim must trigger a credential write. No EPSS data was supplied, and there is no CISA KEV listing. No public POC exists at time of analysis. Despite the low CVSS score, the business impact of stolen provider credentials - API keys and OAuth tokens granting access to third-party accounts - may be disproportionate relative to the base score on shared multi-user systems where ~/.pi/agent has permissive directory permissions. For single-user workstations or systems with owner-only home directories, risk is negligible. The gap between the 2.2 base score and potential credential-theft impact should be weighed for multi-user server deployments.

A local attacker on a shared multi-user system identifies a victim whose ~/.pi/agent directory is world-traversable. The attacker uses inotifywait or a tight polling loop to detect when auth.json is created or rewritten - for example, during an OAuth token refresh triggered by the victim's normal use of Pi - and immediately opens the file in the brief window before permissions are tightened to 0600. If the race is won, the attacker reads API keys or OAuth tokens and uses them to authenticate to the victim's configured provider accounts. No public proof-of-concept code is known; reliably winning the race would require timing tooling and may demand repeated attempts given the High AC classification.