CVE-2026-54326: Pi Terminal Coding XSS Vulnerability

CVE-2026-54326 Overview

CVE-2026-54326 is a cross-site scripting (XSS) vulnerability [CWE-79] in Pi, a minimal terminal coding harness developed by earendil-works. The flaw affects Pi versions 0.74.0 through 0.78.0. When Pi exports session content to a static HTML file, it converts session Markdown into HTML but fails to consistently reject unsafe link and image URL schemes. Attackers can bypass the scheme filter by embedding C0 control characters inside the URL scheme. Browsers normalize these control characters before navigation, allowing dangerous schemes such as javascript: to execute when a user opens the exported HTML file. The issue is fixed in version 0.78.1.

Critical Impact
Successful exploitation requires local access and user interaction, and produces limited confidentiality impact when a victim opens a crafted HTML export.

Affected Products

Pi (earendil-works) versions 0.74.0 through 0.78.0
Pi HTML export functionality in packages/coding-agent/src/core/export-html/template.js
Pi version 0.78.1 and later are not affected

Discovery Timeline

2026-06-23 - CVE-2026-54326 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54326

Vulnerability Analysis

Pi renders session Markdown into static HTML when users export a session. The export pipeline includes a URL scheme allowlist intended to block dangerous schemes like javascript:, data:, and vbscript: in Markdown links and images. The check matches the scheme by parsing characters preceding the colon and comparing against an allowlist.

The filter inspects the raw scheme string without first stripping C0 control characters (bytes \\x00–\\x1f) and \\x7f. A Markdown link such as [click](\\x01javascript:alert(1)) does not match the allowlist as javascript, so the scheme check either passes the value through or fails to recognize it as dangerous. Browsers, however, strip these control characters during URL parsing and resolve the link as javascript:alert(1), executing script in the context of the local HTML file.

Root Cause

The root cause is inconsistent URL normalization between the sanitizer and the browser. The exporter validated scheme strings without applying the same normalization the browser performs. This classic parser-differential issue [CWE-79] allows crafted input to pass server-side validation while still triggering script execution client-side.

Attack Vector

Exploitation requires an attacker to influence Markdown content inside a Pi session and convince a user to export the session and open the resulting HTML file locally. Attack complexity is high and user interaction is required. Impact is limited to the context of the exported file.

javascript

// Patch from packages/coding-agent/src/core/export-html/template.js
           .replace(/'/g, ''');
       }
 
+      function sanitizeMarkdownUrl(value) {
+        const href = String(value || '').trim().replace(/[\\x00-\\x1f\\x7f]/g, '');
+        if (!href) return href;
+
+        const scheme = href.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
+        if (scheme && !/^(https?|mailto|tel|ftp)$/i.test(scheme[1])) {
+          return null;
+        }
+
+        return href;
+      }
+
       /**
        * Truncate string to maxLen chars, append "..." if truncated.
        */

Source: GitHub Commit 6cb23f9. The fix strips C0 control characters and \\x7f before applying the scheme allowlist of https, http, mailto, tel, and ftp.

Detection Methods for CVE-2026-54326

Indicators of Compromise

Pi HTML export files containing Markdown link or image hrefs with embedded bytes in the \\x00–\\x1f or \\x7f ranges before a : scheme delimiter.
Exported HTML containing anchor or image tags whose href or src resolves to javascript:, data:, or vbscript: after control-character stripping.
Pi binaries or npm installs reporting versions between 0.74.0 and 0.78.0.

Detection Strategies

Scan exported HTML artifacts for href and src attribute values matching the regex /[\\x00-\\x1f\\x7f]+[a-zA-Z]+:/ to surface obfuscated scheme payloads.
Inventory developer endpoints for Pi installations and flag versions earlier than 0.78.1 via package manifests or release tags.
Inspect session Markdown sources used to generate exports for link tokens containing non-printable bytes inside the scheme component.

Monitoring Recommendations

Monitor creation of HTML files by the Pi process and review their content before they are shared or opened in browsers.
Log browser navigations originating from file:// URLs on developer workstations to identify post-export script execution.
Track Pi release advisories on the earendil-works GitHub Releases page for subsequent security fixes.

How to Mitigate CVE-2026-54326

Immediate Actions Required

Upgrade Pi to version 0.78.1 or later on all systems where the coding harness is installed.
Discard or re-generate any HTML exports produced by Pi versions 0.74.0 through 0.78.0 that originated from untrusted session content.
Avoid opening Pi HTML exports of unknown provenance in a browser until the host is patched.

Patch Information

The vulnerability is fixed in Pi 0.78.1. The patch introduces a sanitizeMarkdownUrl helper in packages/coding-agent/src/core/export-html/template.js that strips C0 control characters and \\x7f before checking the scheme against an allowlist of https, http, mailto, tel, and ftp. See the GitHub Security Advisory GHSA-7v5m-pr3q-6453 and the v0.78.1 release notes for full details.

Workarounds

Do not export sessions to HTML when running affected Pi versions, particularly for sessions that contain content from untrusted sources.
Open generated HTML exports in a text viewer or sandboxed environment rather than a browser until upgrading to 0.78.1.
Apply local content inspection to strip control characters from Markdown URLs prior to export if upgrading is not immediately possible.

bash

# Verify and upgrade Pi to the fixed release
pi --version
npm install -g pi@0.78.1
pi --version