CVE-2026-54326
CVE-2026-54326 · Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.
CVSS 2.5 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
pi
- Versions
- >= 0.74.0, < 0.78.1: Affected
No fix published
@mariozechner/pi-coding-agent npm
- Affected ranges
- SEMVER: ≥ 0.27.5, ≤ 0.73.1
No fix published
@earendil-works/pi-coding-agent npm
- Affected ranges
- SEMVER: ≥ 0.74.0, < 0.78.1
Update to 0.78.1