AI Threat Alert
CVE-2026-54326 is a low-severity XSS flaw in the pi-coding-agent npm package where C0 control characters bypass Markdown URL scheme filtering, allowing malicious scripts to execute in exported HTML session files. The attack chain is indirect and multi-step — an adversary must first inject a malicious link into the agent's session (e.g., via prompt injection of untrusted code or docs), then the user must export the session as HTML and click the link — limiting realistic blast radius to disclosure of content embedded in that specific session file. With a CVSS of 2.5, EPSS of 0.00019, no active exploitation, no public exploit code, and no CISA KEV listing, immediate enterprise risk is low. Organizations using @earendil-works/pi-coding-agent should upgrade to 0.78.1 and regenerate HTML exports derived from sessions that processed untrusted input.
What is the risk?
Low risk overall. CVSS 2.5 (Local / High Complexity / No Privileges / UI Required) accurately reflects the multi-step, user-dependent exploit chain. No active exploitation, no public PoC, and no KEV listing corroborate the low urgency rating. The most relevant risk factor is the prompt injection entry point — AI coding agents routinely ingest untrusted code, documentation, and repository content, making session poisoning conceptually accessible to an adversary with read access to files the agent processes. However, XSS impact is fully confined to the exported static HTML file (not the agent runtime or host shell), capping the ceiling at limited session-data disclosure. Risk increases meaningfully if exported sessions are routinely shared externally or opened in permissive enterprise browser contexts.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| @earendil-works/pi-coding-agent | npm | >= 0.74.0, < 0.78.1 | 0.78.1 |
| @mariozechner/pi-coding-agent | npm | >= 0.27.5, <= 0.73.1 | No patch |
How severe is it?
What is the attack surface?
What should I do?
5 steps-
Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later immediately.
-
If using the deprecated @mariozechner/pi-coding-agent scope, migrate to @earendil-works/pi-coding-agent and upgrade to 0.78.1+ — no patch is available for the old scope.
-
Regenerate all previously exported HTML session files if those sessions ingested untrusted content (external code repos, user-supplied inputs, web-fetched documentation).
-
As a procedural control pending upgrade, restrict external sharing of raw HTML session exports.
-
Review coding agent session policies to limit exposure to adversarial prompt injection via untrusted files or repositories the agent reads.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-54326?
CVE-2026-54326 is a low-severity XSS flaw in the pi-coding-agent npm package where C0 control characters bypass Markdown URL scheme filtering, allowing malicious scripts to execute in exported HTML session files. The attack chain is indirect and multi-step — an adversary must first inject a malicious link into the agent's session (e.g., via prompt injection of untrusted code or docs), then the user must export the session as HTML and click the link — limiting realistic blast radius to disclosure of content embedded in that specific session file. With a CVSS of 2.5, EPSS of 0.00019, no active exploitation, no public exploit code, and no CISA KEV listing, immediate enterprise risk is low. Organizations using @earendil-works/pi-coding-agent should upgrade to 0.78.1 and regenerate HTML exports derived from sessions that processed untrusted input.
Is CVE-2026-54326 actively exploited?
No confirmed active exploitation of CVE-2026-54326 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-54326?
1. Upgrade @earendil-works/pi-coding-agent to 0.78.1 or later immediately. 2. If using the deprecated @mariozechner/pi-coding-agent scope, migrate to @earendil-works/pi-coding-agent and upgrade to 0.78.1+ — no patch is available for the old scope. 3. Regenerate all previously exported HTML session files if those sessions ingested untrusted content (external code repos, user-supplied inputs, web-fetched documentation). 4. As a procedural control pending upgrade, restrict external sharing of raw HTML session exports. 5. Review coding agent session policies to limit exposure to adversarial prompt injection via untrusted files or repositories the agent reads.
What systems are affected by CVE-2026-54326?
This vulnerability affects the following AI/ML architecture patterns: AI coding assistants, agent frameworks.
What is the CVSS score for CVE-2026-54326?
CVE-2026-54326 has a CVSS v3.1 base score of 2.5 (LOW). The EPSS exploitation probability is 0.02%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003 Malicious Link AML.T0048.003 User Harm AML.T0051.001 Indirect AML.T0080.001 Thread Compliance Controls Affected
What are the technical details?
Original Advisory
# Potential XSS in HTML session exports via Markdown URL handling Pi HTML exports render session Markdown into a static HTML file. Affected versions did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. ## Impact The realistic attack path is indirect. An attacker would need to get suitable Markdown into a session, for example through prompt injection that causes the model to include an unsafe link, or through other untrusted session content. The user would then need to export the session as HTML, open or share that file, and click the link. If triggered, script runs in the exported document, not in pi or the user's shell. The main risk is limited disclosure of data embedded in that exported session file. ## Affected versions - Affected: `@mariozechner/pi-coding-agent >= 0.27.5, <= 0.73.1` - Affected: `@earendil-works/pi-coding-agent >= 0.74.0, < 0.78.1` - Patched: `@earendil-works/pi-coding-agent 0.78.1` The old `@mariozechner/pi-coding-agent` package scope has no patched release. It was renamed to `@earendil-works/pi-coding-agent`; users of the old scope should migrate to the new package and upgrade to version 0.78.1 or later. ## Resolution Version 0.78.1 sanitizes Markdown link and image URLs with an allow-list after stripping C0 control characters. ## Recommendations Upgrade `@earendil-works/pi-coding-agent` to version 0.78.1 or later. Regenerate shared HTML exports after upgrading if the underlying sessions contained untrusted content. ## Timeline - 2026-05-29: Report received through GitHub Security Advisories - 2026-06-02: Fix committed - 2026-06-04: Fixed version 0.78.1 released - 2026-06-08: Advisory prepared for publication ## Credits Reported by Paul Urian and Cosmin Alexa of CrowdStrike.
Exploitation Scenario
An adversary targeting a development team using pi-coding-agent embeds a hidden prompt injection inside a file the agent is asked to review — for example, a comment in a public repository's source code instructing the model to include a javascript: URL (obfuscated with C0 control characters such as a null byte in the scheme prefix to defeat the pre-patch filter) in its code review response. The developer, unaware of the injected content, exports the session as HTML to share the review with a colleague. The colleague opens the file in a browser and clicks what appears to be a legitimate documentation link in the agent's response. The malicious JavaScript executes in the browser, exfiltrating session content — which may include source code, API keys referenced in conversation, or authentication tokens visible in prior session turns — to an attacker-controlled endpoint.
Weaknesses (CWE)
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N References
Timeline
Related Vulnerabilities
CVE-2024-2912 10.0 BentoML: RCE via insecure deserialization (CVSS 10)
Same attack type: Code Execution CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same attack type: Code Execution CVE-2025-5120 10.0 smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Code Execution CVE-2025-59528 10.0 Flowise: Unauthenticated RCE via MCP config injection
Same attack type: Code Execution GHSA-vvpj-8cmc-gx39 10.0 picklescan: security flaw enables exploitation
Same attack type: Code Execution