https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T21:06:14.625523+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54326 CVE-2026-54326 — Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass 2026-10-19T21:06:14.627106+00:00

Affected: earendil-works pi

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.