{"action":"Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later.","affected":[{"fixed":"0.78.1","introduced":"0.74.0"}],"component":"@earendil-works/pi-coding-agent","cve_ids":["CVE-2026-54326"],"ecosystem":"npm","epss":0.00172,"exploited":false,"fixed_versions":["0.78.1"],"ghsa_id":"GHSA-7v5m-pr3q-6453","id":"tcs_01M5KFAXZJVCV45GQBM55FZ671","modified_at":"2026-07-20T21:30:33.172372468Z","published_at":"2026-06-16T23:43:15Z","references":["https://osv.dev/vulnerability/GHSA-7v5m-pr3q-6453","https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453","https://nvd.nist.gov/vuln/detail/CVE-2026-54326","https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010","https://github.com/earendil-works/pi","https://github.com/earendil-works/pi/releases/tag/v0.78.1"],"severity":{"label":"low","score":2.5},"sources":[{"source":"osv","source_id":"GHSA-7v5m-pr3q-6453#npm/@earendil-works/pi-coding-agent","url":"https://osv.dev/vulnerability/GHSA-7v5m-pr3q-6453"}],"summary":"Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass"}