CVE-2026-54326

Published: Jun 23, 2026Modified: Jun 25, 2026Deferred

2.5

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.0 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010

Source: security-advisories@github.com

https://github.com/earendil-works/pi/releases/tag/v0.78.1

Source: security-advisories@github.com

https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453

Source: security-advisories@github.com

Timeline

No history available yet.