LOW2.5npm
GHSA-7v5m-pr3q-6453· CVE-2026-54326Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Modified: 7/20/2026
package
npm/@mariozechner/pi-coding-agent
pkg:npm/%40mariozechner/pi-coding-agent
HIGH7.3npm
GHSA-jfgx-wxx8-mp94· CVE-2026-54328Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Modified: 7/20/2026
LOW2.2npm
GHSA-r95r-rj6r-c39x· CVE-2026-54327Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Modified: 7/20/2026