npm/@mariozechner/pi-coding-agent CVE-2026-54326: low 2.5, EPSS 0.17%
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.27.5 | - | 0.73.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-7v5m-pr3q-6453
- https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453
- https://nvd.nist.gov/vuln/detail/CVE-2026-54326
- https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
CVE-2026-54326 · published · modified · JSON