The vulnerability CVE-2026-54327 in earendil-works pi is a TOCTOU race condition affecting the file write path for auth.json, which stores sensitive API keys and OAuth credentials. Between versions 0.74.0 and 0.78.1, the file permissions are initially set according to the process umask before being tightened to owner-only, allowing a brief window where unauthorized access might occur. This race condition could lead to unintended exposure of sensitive credentials. The issue is resolved in version 0.78.1.

The vulnerability could allow an attacker with local access and the ability to race the file write operation to read sensitive API keys and OAuth credentials during the brief window when auth.json permissions are not yet restricted. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact. The low CVSS score (2.2) reflects that exploitation requires local access, high attack complexity, and user interaction.

Upgrade to earendil-works pi version 0.78.1 or later, where this race condition vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is not explicitly confirmed in the advisory, but the description states the vulnerability is fixed in 0.78.1.