CVE-2026-66918: Pivotick XSS Vulnerability

CVE-2026-66918 Overview

CVE-2026-66918 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Pivotick, a graph rendering library. The library fails to sanitize attacker-controlled Scalable Vector Graphics (SVG) markup supplied through the per-node style.svgIcon property before inserting it into the document. When Pivotick renders a graph node, the vulnerable code assigns the icon markup directly to the innerHTML property of a live SVG element. Attackers who can influence graph data can inject markup containing executable event handlers, such as an <image> element with an onerror attribute, to trigger arbitrary JavaScript execution.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the security context of the embedding application, enabling data theft, content manipulation, and session hijacking.

Affected Products

Pivotick graph rendering library
Applications embedding Pivotick that render attacker-controlled or attacker-modifiable graph data
Versions prior to the fix committed in 8dbfe4ca3582e715535d261535a0d632ce271dea

Discovery Timeline

2026-07-28 - CVE-2026-66918 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66918

Vulnerability Analysis

The vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. Pivotick treats the per-node style.svgIcon value as trusted markup and writes it to a live SVG element's innerHTML. This behavior allows any SVG element attributes, including scripting event handlers, to be parsed and activated by the browser.

Assigning untrusted markup to innerHTML on a live element also initiates subresource loads immediately. A pending <img onerror> handler still fires after the element is later removed, meaning subsequent DOM cleanup does not neutralize the payload. The impact depends on the privileges of the embedding application, but includes access to application data, unauthorized state changes, and actions executed under the victim's authenticated session.

Root Cause

The root cause is missing input sanitization on style.svgIcon inside src/renderers/svg/NodeDrawer.ts. The per-node style bag is as untrusted as the data.* fields sourced from graph input, but was written directly to the DOM without HTML sanitization or allow-list filtering of tags, attributes, and event handlers.

Attack Vector

Exploitation requires an application using Pivotick to render graph data that is controlled or modified by an attacker. The attacker supplies a node whose style.svgIcon contains SVG markup with an event-handler attribute. When a victim loads the graph in the embedding application, the browser parses the markup, and the event handler fires in the victim's session context. User interaction to load or render the malicious graph is required.

typescript

// Patch applied in src/utils/SvgSanitizer.ts
// Sanitizes svgIcon markup with DOMPurify before it reaches a live DOM node.
import DOMPurify from 'dompurify'

export function parseSvgIconMarkup(markup: string): DocumentFragment {
    const trimmed = markup.trim()
    const isRooted = /^<svg[\s>]/i.test(trimmed)

    const clean = DOMPurify.sanitize(isRooted ? trimmed : `<svg>${trimmed}</svg>`, {
        USE_PROFILES: { svg: true, svgFilters: true },
        RETURN_DOM_FRAGMENT: true,
    })
    if (isRooted) return clean

    const wrapper = clean.firstElementChild
    const unwrapped = document.createDocumentFragment()
    while (wrapper?.firstChild) {
        unwrapped.appendChild(wrapper.firstChild)
    }
    return unwrapped
}
// Source: https://github.com/Pivotick/Pivotick/commit/8dbfe4ca3582e715535d261535a0d632ce271dea

Detection Methods for CVE-2026-66918

Indicators of Compromise

Graph data payloads containing style.svgIcon values with <image>, <script>, or onerror/onload attributes.
Outbound requests to attacker-controlled hosts originating from user browser sessions viewing graph visualizations.
Unexpected DOM modifications or injected <script> and <foreignObject> elements within rendered SVG node icons.

Detection Strategies

Inspect stored graph documents and API responses for SVG event-handler attributes inside node style fields.
Enable Content Security Policy (CSP) reporting to capture inline script and event-handler violations from application pages that render graphs.
Review application logs for graph ingestion or import events that include large or unusual style.svgIcon payloads.

Monitoring Recommendations

Monitor client-side JavaScript errors and CSP violation reports for unexpected script execution on pages embedding Pivotick.
Track authenticated user actions that occur immediately after graph rendering events for signs of session abuse.
Alert on graph data mutations performed by low-privilege users that introduce SVG markup into style.svgIcon fields.

How to Mitigate CVE-2026-66918

Immediate Actions Required

Upgrade Pivotick to a version that includes commit 8dbfe4ca3582e715535d261535a0d632ce271dea or later.
Audit any persisted graph data for SVG markup containing scripting attributes and remove or sanitize offending records.
Restrict who can create or modify graph data consumed by Pivotick until the patched build is deployed.

Patch Information

The fix introduces parseSvgIconMarkup in src/utils/SvgSanitizer.ts, which sanitizes style.svgIcon with DOMPurify using the SVG profile and returns a sanitized DocumentFragment. The renderer in src/renderers/svg/NodeDrawer.ts was updated to use this helper instead of assigning markup to innerHTML. See the Pivotick security commit for the complete change.

Workarounds

Server-side sanitize all style.svgIcon values with a hardened SVG allow-list (for example, DOMPurify with the svg profile) before persistence or delivery to clients.
Deploy a strict Content Security Policy that disables inline event handlers and blocks unexpected script sources on pages hosting Pivotick.
Disable or omit the style.svgIcon field entirely from graph inputs sourced from untrusted users.

bash

# Example: pin Pivotick to a patched version in package.json and reinstall
npm install pivotick@latest
npm audit --production