CVE-2026-5533
Description
A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts of the component SVG Artifact Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A cross-site scripting vulnerability in pi-mono 0.58.4's SVG Artifact Handler allows remote attackers to inject arbitrary web scripts.
Vulnerability
Description The vulnerability resides in the SvgArtifact.ts file of the packages/web-ui/src/tools/artifacts directory within the pi-mono project version 0.58.4. The issue stems from improper neutralization of user input during SVG artifact handling, leading to reflected or stored cross-site scripting (XSS). The vendor, badlogic, was contacted but did not respond [1].
Exploitation
The attack vector is remote and does not require authentication. By crafting a malicious SVG artifact containing JavaScript payloads, an attacker can inject and execute arbitrary code in the context of the affected web application. The exploit has been publicly disclosed, increasing the risk of active exploitation [1].
Impact
Successful exploitation could allow an attacker to steal session cookies, access sensitive data, perform actions on behalf of the victim, or deface the application. Given the medium CVSS v3 base score of 4.3, the impact is limited but the public availability of exploit details elevates the practical risk [1].
Mitigation
As of this writing, no patch or vendor advisory has been released. Users should consider disabling the SVG artifact handler or implementing strict input validation and output encoding as a temporary workaround. Monitoring for updates from the vendor or community forks is recommended [1].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.