{"id":"EUVD-2026-38582","enisaUuid":"1cd7372c-a20b-3dd2-bdb5-e9214e13dcc4","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.","datePublished":"Jun 23, 2026, 7:28:22 PM","dateUpdated":"Jun 26, 2026, 6:09:58 PM","baseScore":2.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","references":"https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x\nhttps://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","aliases":"CVE-2026-54327\nGHSA-r95r-rj6r-c39x\n","assigner":"GitHub_M","epss":0.09,"enisaIdProduct":[{"id":"86e3410b-ff7f-3f75-8a60-f5cd1585a1f7","product":{"name":"pi","vendor":{"name":"earendil-works"}},"product_version":"0.74.0, \u003c 0.78.1"}],"enisaIdVendor":[{"id":"fb2fdb9b-a65f-393d-8140-f09b0d366441","vendor":{"name":"earendil-works"}}],"enisaIdVulnerability":[{"id":"3d176dd6-b0c4-3202-9b7d-47a1bfccfb4f","vulnerability":{"id":"GHSA-r95r-rj6r-c39x","description":"Pi Agent: Race condition in Pi auth.json writes could expose stored credentials","datePublished":"Jun 17, 2026, 1:54:37 PM","dateUpdated":"Jul 20, 2026, 9:12:58 PM","baseScore":0.0,"references":"https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54327\nhttps://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347\nhttps://github.com/earendil-works/pi\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","enisa_id":"EUVD-2026-38582\n","aliases":"CVE-2026-54327\nGHSA-r95r-rj6r-c39x\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4c7e7270-f7c1-3965-83c0-a75f7873f780","vulnerability":{"id":"CVE-2026-54327","description":"Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.","datePublished":"Jun 23, 2026, 7:28:22 PM","dateUpdated":"Jun 26, 2026, 6:09:58 PM","status":"PUBLISHED","baseScore":2.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","references":"https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x\nhttps://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347\nhttps://github.com/earendil-works/pi/releases/tag/v0.78.1\n","enisa_id":"EUVD-2026-38582\n","assigner":"GitHub_M","epss":0.09,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"44aef01b-3bee-353d-af35-f597fd73a9d4","product":{"name":"pi","vendor":{"name":"earendil-works"}},"product_version":"0.74.0, \u003c 0.78.1"}],"vulnerabilityVendor":[{"id":"c858022a-69f0-39ce-b030-2ce53a45e82c","vendor":{"name":"earendil-works"}}]}}],"enisaIdAdvisory":[]}