Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. This vulnerability is fixed in 0.78.1.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도 | 25.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 25.00 |
VPI 공식 vpi-v1 기준
| 소스 | CVSS 버전 | 기본 점수 | 심각도 | 벡터 문자열 | 평가일 |
|---|---|---|---|---|---|
| NVDNIST | 3.1 | 2.5 | LOW | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N | 2026. 06. 24. |
| OSV3rd | 3.1 | 2.5 | LOW |
| CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
| 2026. 06. 17. |