Description
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. This vulnerability is fixed in 0.78.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| earendil-works | pi | >= 0.74.0, < 0.78.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @earendil-works/pi-coding-agent | >= 0.74.0, < 0.78.1 | 0.78.1 | GHSA-r95r-rj6r-c39x |
| npm | @mariozechner/pi-coding-agent | >= 0.28.0, <= 0.73.1 | — | GHSA-r95r-rj6r-c39x |