2.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54326

CVE-2026-54326: Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54326

CVE-2026-54326:

2.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@mariozechner/pi-coding-agent	npm	>= 0.27.5, <= 0.73.1
@earendil-works/pi-coding-agent	npm	>= 0.74.0, < 0.78.1	0.78.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the HTML export functionality of the Pi Agent, specifically in how it processes markdown links and images. The root cause is improper sanitization of URLs provided in markdown content. The functions link and image within the markdown renderer used a weak blocklist-based approach to filter out malicious URL schemes like javascript:. This filter was susceptible to bypass through the use of C0 control characters, which are stripped by browsers during URL normalization.

The patch addresses this by introducing a new sanitization function, sanitizeMarkdownUrl. This function first strips any C0 control characters from the URL and then validates the URL's scheme against a strict allow-list (http, https, mailto, tel, ftp). The link and image renderer functions were updated to use this new, more secure sanitization logic. Any URL that does not have an allowed scheme is rejected, preventing the XSS vulnerability. An attacker exploiting this would need to inject malicious markdown into a session, which would then be triggered when a user exports that session to an HTML file and clicks the malicious link.

Vulnerable functions

link

packages/coding-agent/src/core/export-html/template.js

The `link` function within the markdown renderer is responsible for creating anchor tags from markdown links. The vulnerable version used a regular expression to block dangerous URL schemes like `javascript:`. However, this check could be bypassed by inserting C0 control characters (e.g., `java\x01script:`) into the URL. Browsers normalize these characters before processing the URL, leading to the execution of the malicious script. The function processes user-controllable markdown, and its output is rendered in an HTML export, making it a vector for XSS.

image

packages/coding-agent/src/core/export-html/template.js

Similar to the `link` function, the `image` function in the markdown renderer was responsible for creating `<img>` tags. It used the same flawed URL sanitization logic based on a blocklist regex. An attacker could provide a markdown image with a malicious URL (e.g., `![alt](javascript:alert(1))`) that bypasses the filter using control characters. When the user exports the session to HTML, this would result in an `<img>` tag with a `src` attribute that executes JavaScript, leading to XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.