Cross-Site Scripting in Pi by Earendil Works

CVE-2026-54326

What is CVE-2026-54326?

The Pi terminal coding harness has a vulnerability affecting versions from 0.74.0 to 0.78.1, where the HTML export feature inadequately filters unsafe Markdown link and image URL schemes. Specifically, C0 control characters found in the URL scheme can circumvent the existing checks due to normalization performed by browsers. This issue poses a security risk as it may allow attackers to inject malicious content through properly formatted URLs. The vulnerability is addressed in version 0.78.1, which implements improved filtering mechanisms.

References