{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.27.5","last_affected":"0.73.1"}],"component":"@mariozechner/pi-coding-agent","cve_ids":["CVE-2026-54326"],"ecosystem":"npm","epss":0.00172,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7v5m-pr3q-6453","id":"tcs_01M5KFAXR7ZP47X6QXBEE1P144","modified_at":"2026-07-20T21:30:33.172372468Z","published_at":"2026-06-16T23:43:15Z","references":["https://osv.dev/vulnerability/GHSA-7v5m-pr3q-6453","https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453","https://nvd.nist.gov/vuln/detail/CVE-2026-54326","https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010","https://github.com/earendil-works/pi","https://github.com/earendil-works/pi/releases/tag/v0.78.1"],"severity":{"label":"low","score":2.5},"sources":[{"source":"osv","source_id":"GHSA-7v5m-pr3q-6453","url":"https://osv.dev/vulnerability/GHSA-7v5m-pr3q-6453"}],"summary":"Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass"}