Pivotick vulnerabilities

Products

• Pivotick 8

Latest Pivotick CVEs

Newest publication first

1. CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

   Published 2026-07-28

   Critical·CVSS 9.2

   Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a <template> element through innerHTML. Strings der...

2. CVE-2026-67173 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

   Published 2026-07-28

   Medium·CVSS 5.1

   Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser...

3. CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

   Published 2026-07-28

   Medium·CVSS 5.1

   Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not h...

4. CVE-2026-66921 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References

   Published 2026-07-28

   Medium·CVSS 6.3

   Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference tokenizer rejected only square brackets,...

5. CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

   Published 2026-07-28

   High·CVSS 8.2

   Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted g...

6. CVE-2026-66919 Stored DOM-Based Cross-Site Scripting in Node Modal Headers

   Published 2026-07-28

   Medium·CVSS 6.9

   Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could ins...

7. CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

   Published 2026-07-28

   High·CVSS 8.2

   Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG elem...

8. CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

   Published 2026-07-27

   Medium·CVSS 6.9

   Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to sup...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.