npm/@earendil-works/pi-coding-agent CVE-2026-54326: low 2.5, EPSS 0.17%
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Action: Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later.
npm i @earendil-works/pi-coding-agent@0.78.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.74.0 | 0.78.1 | - |
Fixed versions
| 0.78.1 |
Sources
- osv: GHSA-7v5m-pr3q-6453#npm/@earendil-works/pi-coding-agent
- https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453
- https://nvd.nist.gov/vuln/detail/CVE-2026-54326
- https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
- https://github.com/earendil-works/pi
- https://github.com/earendil-works/pi/releases/tag/v0.78.1
CVE-2026-54326 · published · modified · JSON