2.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54327

CVE-2026-54327: Pi: Race condition in auth.json writes could expose stored credentials

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54327

CVE-2026-54327:

2.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@mariozechner/pi-coding-agent	npm	>= 0.28.0, <= 0.73.1
@earendil-works/pi-coding-agent	npm	>= 0.74.0, < 0.78.1	0.78.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in the handling of the auth.json file, which stores sensitive credentials. The analysis of the patch commit 135fb545f99106a4a249274f129b90bc0a77d347 reveals that the file was being written with default system permissions first, and then its permissions were restricted to owner-only (0o600) in a separate step. This creates a small time window where a local attacker could potentially read the contents of auth.json before the permissions are tightened.

The patch addresses this by using the mode option in the writeFileSync call, ensuring the file is created with the correct restrictive permissions from the very beginning. The functions FileAuthStorageBackend.ensureFileExists, FileAuthStorageBackend.withLock, and FileAuthStorageBackend.withLockAsync in packages/coding-agent/src/core/auth-storage.ts were all identified as vulnerable because they performed this unsafe file writing operation. An attacker triggering this vulnerability would cause these functions to appear in a runtime profile.

Vulnerable functions

FileAuthStorageBackend.ensureFileExists

packages/coding-agent/src/core/auth-storage.ts

This function creates the auth.json file. Before the patch, it wrote the file with default permissions and then changed them, creating a race condition. The vulnerable code is the call to writeFileSync without specifying the file mode.

FileAuthStorageBackend.withLock

packages/coding-agent/src/core/auth-storage.ts

This function writes to the auth.json file. Before the patch, it wrote the file with default permissions and then changed them, creating a race condition. The vulnerable code is the call to writeFileSync without specifying the file mode.

FileAuthStorageBackend.withLockAsync

packages/coding-agent/src/core/auth-storage.ts

This function writes to the auth.json file asynchronously. Before the patch, it wrote the file with default permissions and then changed them, creating a race condition. The vulnerable code is the call to writeFileSync without specifying the file mode.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.