CVE-2026-54326

Name of the Vulnerable Software and Affected Versions @mariozechner/pi-coding-agent versions 0.27.5 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0

Description Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe Markdown link and image URL schemes. In versions implementing scheme filtering, C0 control characters (non-printable characters in the ASCII range 0-31) in the URL scheme can bypass security checks because web browsers normalize these characters before navigation. This can lead to Cross-Site Scripting (XSS), where an attacker could execute scripts in the exported document if they successfully inject unsafe Markdown into a session, such as through prompt injection. The primary risk is the limited disclosure of data embedded within the exported session file.

Recommendations Update @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent version 0.78.1 or later. Update @earendil-works/pi-coding-agent to version 0.78.1 or later. Regenerate shared HTML exports after upgrading if the underlying sessions contained untrusted content.