Is there a public PoC exploit available for CVE-2026-5533?

Yes, a public proof-of-concept exploit is available for CVE-2026-5533. Prioritise patching immediately. EPSS: 0.0%.

Pi Mono CVE-2026-5533

Q: What is the CVSS score of CVE-2026-5533?

CVE-2026-5533 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19015 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-05 VulDB

GHSA-87fw-5q57-v2v9

XSS Pi Mono Badlogic

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 01:45 euvd

EUVD-2026-19015

Analysis Generated

Apr 05, 2026 - 01:45 vuln.today

CVE Published

Apr 05, 2026 - 01:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts of the component SVG Artifact Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting (XSS) in badlogic pi-mono 0.58.4 SVG Artifact Handler allows unauthenticated remote attackers to inject malicious scripts via the SvgArtifact.ts component, affecting application integrity when users interact with crafted SVG artifacts. Publicly available exploit code exists, and the vendor has not responded to disclosure despite early notification.

Technical ContextAI

The vulnerability resides in the SVG Artifact Handler component (packages/web-ui/src/tools/artifacts/SvgArtifact.ts) of badlogic pi-mono, a web-based application framework. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input sanitization or output encoding when processing SVG artifacts. Attackers can embed malicious JavaScript payloads within SVG content that execute in the browser context of other users when those artifacts are rendered or previewed, compromising the confidentiality of user interactions and potentially enabling session hijacking or credential theft through reflected or stored XSS mechanisms.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor has not responded to disclosure efforts. Immediate mitigation requires implementing content security policy (CSP) headers to restrict inline script execution and disable SVG script execution where possible. Apply strict input validation and output encoding to all SVG artifact processing, ensuring SVG content is sanitized or rendered as static images rather than executable markup. Consider disabling SVG artifact functionality entirely if not essential, or restrict access to trusted users only. Monitor for indicators of exploitation (unusual script execution in SVG contexts). Users should contact badlogic directly to pressure vendor engagement and request a patched release; monitor the project repository (https://github.com/August829/CVEP/issues/20) and VulDB (https://vuldb.com/vuln/355286) for future updates.