Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54326 · Microsoft / collected KEV context

EUVD-2026-38581

GHSA-7v5m-pr3q-6453

cve-program · CVE-2026-54326

• https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453
• https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

euvd · EUVD-2026-38581

• https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453
• https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

nvd · CVE-2026-54326

• https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
• https://github.com/earendil-works/pi/releases/tag/v0.78.1
• https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453

osv · GHSA-7v5m-pr3q-6453

• https://github.com/earendil-works/pi/security/advisories/GHSA-7v5m-pr3q-6453
• https://nvd.nist.gov/vuln/detail/CVE-2026-54326
• https://github.com/earendil-works/pi/commit/6cb23f9b5d5b6d1747672f535b167d0d809ac010
• https://github.com/earendil-works/pi
• https://github.com/earendil-works/pi/releases/tag/v0.78.1

No related operational record is retained in the current change model.