CVE-2026-54326

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54326
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54326.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54326
Aliases
Downstream
Published
2026-06-23T19:26:35.875Z
Modified
2026-08-12T03:51:17.168755582Z
Severity
  • 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Details

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54326.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/earendil-works/pi

Affected ranges

Type
GIT
Repo
https://github.com/earendil-works/pi
Events
Introduced
1eee081e29c1323c40b98db11d0a62b919831881
Fixed
6cb23f9b5d5b6d1747672f535b167d0d809ac010
Fixed
592c34c05643d115d6eed08a6f615999651cfaa3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.74.0"
        },
        {
            "fixed": "0.78.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54326.json"