npm/@earendil-works/pi-coding-agent CVE-2026-54327: low 2.2, EPSS 0.09%

Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

Action: Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later.

npm i @earendil-works/pi-coding-agent@0.78.1

Affected

Fixed versions

Sources

• osv: GHSA-r95r-rj6r-c39x#npm/@earendil-works/pi-coding-agent
• https://github.com/earendil-works/pi/security/advisories/GHSA-r95r-rj6r-c39x
• https://nvd.nist.gov/vuln/detail/CVE-2026-54327
• https://github.com/earendil-works/pi/commit/135fb545f99106a4a249274f129b90bc0a77d347
• https://github.com/earendil-works/pi
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

CVE-2026-54327 · published 2026-06-17T13:54:37Z · modified 2026-07-20T21:30:42.044931917Z · JSON