CVE-2026-54326 Details

A cross-site scripting vulnerability has been identified in Pi, a minimal terminal coding harness, affecting versions 0.74.0 prior to 0.78.1. The issue arises in the HTML export feature, which converts session Markdown into static HTML files. Affected versions did not consistently filter unsafe URL schemes in Markdown links and images. In versions with some scheme filtering, C0 control characters could bypass the checks, as browsers normalize these characters before navigation. This vulnerability allows for the injection of malicious scripts that could be executed when the exported HTML file is opened.

Users should upgrade to Pi version 0.78.1 or later, which addresses the vulnerability by properly sanitizing Markdown link and image URLs with an allow-list after removing control characters. If the HTML export feature was used to share sessions containing untrusted content, it is recommended to regenerate the export after upgrading.