CVE-2026-66919: Pivotick XSS Vulnerability

CVE-2026-66919 Overview

CVE-2026-66919 is a cross-site scripting (XSS) vulnerability in Pivotick, a graph visualization application. The flaw exists in the inspect and edit node modals, where node labels and descriptions from graph data were interpolated directly into HTML used to build modal headers. An attacker who can supply or modify graph data can inject HTML or JavaScript into a node's label or description. The payload executes in the application's origin when a user opens the affected node's inspect or edit modal. Successful exploitation lets the attacker access information available to the victim, modify application data, or perform actions using the victim's session. The issue is categorized under [CWE-79].

Critical Impact
Attackers with control over graph data can execute arbitrary JavaScript in a victim's browser session when the victim opens an affected node modal.

Affected Products

Pivotick graph visualization application
Versions prior to commit 71d72d5 on the main branch
Deployments loading untrusted or user-supplied graph data

Discovery Timeline

2026-07-28 - CVE-2026-66919 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66919

Vulnerability Analysis

The vulnerability resides in the modal construction logic used by Pivotick's inspect and edit node views. The application built modal header markup by interpolating nodeNameGetter(node, ...) output directly into an HTML template string. Because the template was subsequently parsed as HTML, any markup embedded in a node's label or description was rendered as live DOM. This includes <script> tags, event handler attributes, and other executable HTML constructs. The payload runs with the privileges of the currently authenticated user, in the origin of the Pivotick application. Attackers can leverage this to exfiltrate session data, invoke authenticated API calls, or pivot to further client-side attacks against other users viewing the same graph.

Root Cause

The root cause is unsafe interpolation of untrusted graph data into an HTML string during modal construction. Node labels and descriptions were treated as trusted markup rather than as text content, bypassing the browser's built-in escaping that would occur when using textContent or equivalent safe DOM APIs.

Attack Vector

Exploitation requires an attacker to influence graph data consumed by Pivotick, then wait for a user to open the inspect or edit modal for a malicious node. User interaction is required to trigger the payload, but no authentication is needed on the network path itself.

typescript

// Patch from Pivotick commit 71d72d59234c65c423cb8d45eaa291a7b2a9b5e1
// File: src/ui/elements/modals/editNodeModal/EditNodeModal.ts
            <div class="icon-container"></div>
            <div class="nodeinfo-container">
                <div>Editing node: </div>
-               <div class="nodeinfo-name">${nodeNameGetter(node, uiManager.getOptions().mainHeader)}</div>
+               <div class="nodeinfo-name"></div>
            </div>
        </div>
    `) as HTMLDivElement
+   // The label is graph data: assign it as text, never interpolate as markup.
+   const nameEl = header.querySelector('.nodeinfo-name')
+   if (nameEl) nameEl.textContent = nodeNameGetter(node, uiManager.getOptions().mainHeader)
    header.querySelector('.icon-container')?.appendChild(createNodePreview(node, { size: fixedPreviewSize, className: 'icon' }))

Source: Pivotick commit 71d72d5. The fix removes the interpolated expression from the HTML template and assigns the node label via textContent, which prevents the browser from parsing the value as markup.

Detection Methods for CVE-2026-66919

Indicators of Compromise

Node labels or descriptions containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> in stored graph data.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after opening a Pivotick modal.
Session tokens or authenticated API calls originating from unusual client contexts tied to Pivotick usage.

Detection Strategies

Scan stored graph data for HTML control characters and tag patterns in node label and description fields.
Review browser Content Security Policy (CSP) violation reports for inline script executions on Pivotick origins.
Inspect application logs for graph imports or edits that introduce suspicious payload strings.

Monitoring Recommendations

Alert on any graph data ingest containing <, >, on\w+=, or javascript: substrings inside node label or description fields.
Monitor authenticated API traffic for anomalous actions occurring immediately after modal-open events.
Track deployed Pivotick commit hashes across environments to confirm the patched build is in place.

How to Mitigate CVE-2026-66919

Immediate Actions Required

Update Pivotick to a build that includes commit 71d72d5 or later.
Audit existing graph datasets for stored payloads in node labels and descriptions.
Restrict who can create or modify graph data to trusted users until the patch is deployed.

Patch Information

The vulnerability is fixed in Pivotick commit 71d72d5. The fix constructs modal elements without embedding graph data into HTML strings and assigns node labels and descriptions through textContent, ensuring values are treated as text rather than markup.

Workarounds

Sanitize or reject graph data containing HTML markup at ingest time until the patch is applied.
Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources.
Limit access to the inspect and edit modals for graphs sourced from untrusted origins.

bash

# Example Content Security Policy header to reduce XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'