CVE-2026-54326: Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-79

Description

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.

Affected products

earendil-works pi: from 0.74.0, < 0.78.1

References

https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
https://github.com/earendil-works/pi/releases/tag/v0.78.1
https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453

Get alerted when CVE-2026-54326 or the next vulnerability affects your stack