The vulnerability CVE-2026-54327 in earendil-works pi is a TOCTOU race condition affecting the file write path for auth.json, which stores API keys and OAuth credentials. Between versions 0.74.0 and 0.78.0, the file could briefly have permissions derived from the process umask, potentially exposing sensitive credentials before permissions are tightened to owner-only. This race condition could allow local attackers with limited privileges to access sensitive authentication data during the window when permissions are not yet restrictive. The vulnerability is resolved in version 0.78.1.

The impact is limited to a brief exposure of sensitive API keys and OAuth credentials stored in auth.json due to improper file permission handling during file writes. The CVSS score of 2.2 (low) reflects that exploitation requires local access with low privileges and user interaction, and the confidentiality impact is limited. There is no impact on integrity or availability.

Upgrade earendil-works pi to version 0.78.1 or later where this race condition is fixed. Since the vendor advisory indicates the issue is resolved in 0.78.1, applying this official fix fully mitigates the vulnerability. No other specific mitigations are indicated.