CVE-2026-66825: Pivotick Sidebar Property XSS Vulnerability

CVE-2026-66825 Overview

CVE-2026-66825 is a cross-site scripting (XSS) vulnerability in Pivotick, a graph visualization application. The flaw resides in the sidebar property-list component, which renders values associated with link-like properties (such as url, uri, href, link, website, or homepage) as hyperlinks without validating the URL scheme. An attacker who can supply or influence node or edge property data can inject a javascript: URI, including variants obfuscated with whitespace or control characters. When a victim clicks the generated link, attacker-controlled JavaScript executes within the Pivotick application context [CWE-79].

Critical Impact
Successful exploitation allows an attacker to access data available to the victim's browser session or perform actions with the victim's privileges within Pivotick.

Affected Products

Pivotick graph visualization application (versions prior to commit 84ddc064d53e9e20cce4077d1192bfdb3aecf17b)
The vulnerable component is src/ui/elements/Sidebar/PropertyList.ts
Deployments accepting untrusted node or edge property data are exposed

Discovery Timeline

2026-07-27 - CVE-2026-66825 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66825

Vulnerability Analysis

The Pivotick sidebar property list treats certain well-known property keys as hyperlinks. The looksLikeLink function in PropertyList.ts returned true for any non-empty value whose key matched an entry in LINK_KEYS, without inspecting the URL scheme. The rendered element preserved the raw value in an href attribute, allowing schemes such as javascript:, data:, and vbscript: to execute when clicked.

Browsers ignore ASCII whitespace and control characters inside a URL scheme, so payloads like java\tscript: or java\nscript: bypass naive prefix checks. This allowed obfuscated variants of the classic javascript: XSS payload to reach the DOM as clickable links.

Root Cause

The root cause is missing output validation of the URL scheme before rendering user-controlled property values as hyperlinks. The renderer trusted the property's semantic key (for example, website) rather than validating the value.

Attack Vector

An attacker who can insert or modify graph node or edge properties supplies a payload such as javascript:alert(document.cookie) under a link-like key. When a user views the affected node in the sidebar and clicks the property link, the injected script executes in the origin of the Pivotick application.

typescript

     return tryResolveHTMLElement(name, element)?.textContent ?? ''
 }
 
+// True when `value` carries a URL scheme that isn't in our allowlist (e.g.
+// `javascript:`, `data:`, `vbscript:`). A scheme-less value is a relative path
+// and can't execute script, so it's considered safe. Browsers ignore ASCII
+// whitespace/control chars inside a scheme (`java\tscript:` ≡ `javascript:`),
+// so strip those before deciding.
+function hasUnsafeScheme(value: string): boolean {
+    // eslint-disable-next-line no-control-regex -- stripping control chars is the point
+    const normalized = value.replace(/[\\x00-\\x20]+/g, '')
+    if (!/^[a-z][a-z0-9+.-]*:/i.test(normalized)) return false
+    return !ABSOLUTE_URL.test(normalized)
+}
+
 function looksLikeLink(key: string, value: string): boolean {
+    if (hasUnsafeScheme(value)) return false
     if (ABSOLUTE_URL.test(value)) return true
     return LINK_KEYS.has(key.toLowerCase()) && value.length > 0
 }

Source: GitHub Commit 84ddc06

Detection Methods for CVE-2026-66825

Indicators of Compromise

Graph node or edge properties containing values that begin with javascript:, data:, or vbscript: under keys such as url, uri, href, link, website, or homepage
Property values containing ASCII control characters or whitespace embedded inside a URL scheme (for example, java\tscript:)
Browser console errors or unexpected script execution originating from the Pivotick application origin

Detection Strategies

Scan stored graph datasets for property values matching the regular expression ^[\\x00-\\x20]*[a-z][a-z0-9+.\-]*: where the resolved scheme is not http or https
Review application ingestion pipelines for untrusted sources of node or edge property data
Audit browser Content Security Policy (CSP) violation reports for script-src or navigate-to blocks originating from the Pivotick UI

Monitoring Recommendations

Log and alert on graph imports that introduce property values with non-http/https schemes
Monitor client-side error telemetry for unexpected script execution within the Pivotick origin
Track access to sensitive data or state-changing endpoints immediately following user interaction with sidebar property links

How to Mitigate CVE-2026-66825

Immediate Actions Required

Upgrade Pivotick to a build that includes commit 84ddc064d53e9e20cce4077d1192bfdb3aecf17b or later
Sanitize existing graph datasets by removing or normalizing property values with non-allowlisted URL schemes
Restrict who can supply or modify node and edge property data to trusted authenticated users

Patch Information

The vulnerability was addressed in the Pivotick repository by introducing a hasUnsafeScheme helper that strips ASCII control characters and whitespace before checking whether the resolved scheme is on the allowlist. The looksLikeLink function now rejects values whose scheme is not http or https, preventing them from being rendered as clickable links. See the Pivotick security commit for the full change.

Workarounds

Deploy a strict Content Security Policy that forbids inline script execution and javascript: navigation targets
Pre-process imported graph data to strip or reject property values whose scheme is not http or https
Educate users to avoid clicking property links in graphs sourced from untrusted parties until the patch is applied

bash

# Example: strip unsafe-scheme values from a Pivotick JSON export before import
jq 'walk(if type == "object" then
    with_entries(
      if (.key | ascii_downcase | IN("url","uri","href","link","website","homepage"))
         and (.value | type == "string")
         and (.value | gsub("[\\u0000-\\u0020]+"; "") | test("^(?i)(javascript|data|vbscript):"))
      then .value = "" else . end)
  else . end)' graph.json > graph.sanitized.json