LOW2.5npm
GHSA-7v5m-pr3q-6453· CVE-2026-54326Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Modified: 7/20/2026
package
npm/@earendil-works/pi-coding-agent
pkg:npm/%40earendil-works/pi-coding-agent
HIGH7.3npm
GHSA-jfgx-wxx8-mp94· CVE-2026-54328Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Modified: 7/20/2026
MEDIUM4.4npm
GHSA-mqxh-6gq7-558m· CVE-2026-54325Pi Agent: Pi loads project-local extensions without approval
Modified: 7/20/2026
LOW2.2npm
GHSA-r95r-rj6r-c39x· CVE-2026-54327Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Modified: 7/20/2026