npm/@mariozechner/pi-coding-agent CVE-2026-54327: low 2.2, EPSS 0.09%
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.28.0 | - | 0.73.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-r95r-rj6r-c39x
- https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
- https://nvd.nist.gov/vuln/detail/CVE-2026-54327
- https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
CVE-2026-54327 · published · modified · JSON