GHSA-7v5m-pr3q-6453: Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Summary

Affected versions of the Pi coding agent's HTML session export did not consistently reject unsafe Markdown link and image URL schemes, and in versions with scheme filtering, C0 control characters in the scheme could bypass the check. An attacker who gets crafted Markdown into a session, for example via prompt injection, can cause script to run in the exported HTML file when a user opens it and clicks the link, risking disclosure of data embedded in that session file.

Mitigation

Upgrade `@earendil-works/pi-coding-agent` to version 0.78.1 or later, which sanitizes Markdown link and image URLs with an allow-list after stripping C0 control characters. Regenerate shared HTML exports after upgrading if the underlying sessions contained untrusted content. Users of the old `@mariozechner/pi-coding-agent` scope should migrate to the new package, since no patched release exists under that scope.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database