CVE-2026-66921: Pivotick Markdown Renderer XSS Flaw

CVE-2026-66921 Overview

CVE-2026-66921 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Pivotick's Markdown node-reference renderer. The renderer fails to HTML-escape the attacker-controlled nodeName value before interpolating it into a generated <span> element and its data-node-name attribute. Attackers can craft a node name containing quotation marks, angle brackets, or event-handler attributes to inject arbitrary HTML into rendered notes or graphs.

Critical Impact
When a victim opens a crafted graph or note, injected JavaScript executes in the application's origin, allowing session theft, same-origin data access, and unauthorized actions on behalf of the user.

Affected Products

Pivotick (Markdown node-reference renderer in nodeReferenceExtension.ts)
Pivotick JsonViewer UI component
Consumers rendering node-reference content without DOMPurify or equivalent sanitization

Discovery Timeline

2026-07-28 - CVE-2026-66921 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66921

Vulnerability Analysis

The flaw is a classic output-encoding failure in a Markdown extension. The node-reference tokenizer only rejected square brackets when parsing node names, permitting HTML metacharacters to pass through. The renderer then inserted the raw nodeName into both the text body of a <span> and its quoted data-node-name attribute. An attacker can terminate the attribute with a quotation mark and append an event-handler attribute such as onerror or onmouseover, or close the tag and inject fresh HTML.

Exploitation requires user interaction: the victim must open or render a crafted graph or note. Once triggered, injected script runs in the security context of the Pivotick application, exposing session tokens, local storage, and any same-origin API surface.

Root Cause

The shared HTML escaping utility was not applied to nodeName before string interpolation. The tokenizer's allowlist stopped only at [ and ], treating <, >, ", ', and & as valid content. Downstream consumers that skipped DOMPurify inherited the unsanitized markup verbatim.

Attack Vector

An attacker with write access to notes, graphs, or any shared content that Pivotick renders as Markdown creates a node reference whose name contains an HTML payload. When another user views the content, the browser parses the injected markup and executes the attacker's script.

typescript

// Patch: src/plugins/noteContentRenderers/markdown/extensions/nodeReferenceExtension.ts
 import type { MarkedExtension, Tokens } from 'marked'
+import { escapeHtml } from '../../../../utils/utils'
 
 interface NodeReferenceToken extends Tokens.Generic {
     type: 'node-reference'

// Patch: src/ui/components/JsonViewer.ts
 import '../../styles/components/jsonViewer.scss'
 import { createButton } from './Button'
+import { escapeHtml } from '../../utils/utils'

// Source: https://github.com/Pivotick/Pivotick/commit/4c13ff2b0ec769881b5526feddef37c0c5a08885

The patch imports a shared escapeHtml function and applies it to nodeName before insertion. The escaper encodes &, <, >, ", and ' so both HTML text and quoted attribute contexts are safe.

Detection Methods for CVE-2026-66921

Indicators of Compromise

Node names in stored Markdown or graph data containing <, >, ", ', or onerror=, onload=, onmouseover= substrings.
Rendered <span data-node-name="..."> elements whose attribute values contain unescaped quotation marks or angle brackets.
Browser console errors or Content Security Policy (CSP) violations originating from Pivotick-rendered notes.

Detection Strategies

Scan the content store for node-reference tokens whose nodeName field contains HTML metacharacters or JavaScript event-handler keywords.
Diff rendered HTML output against a known-good baseline to identify unexpected tags or attributes emitted by the Markdown pipeline.
Enable CSP reporting and monitor for inline-script or event-handler violations on pages that render user-generated Markdown.

Monitoring Recommendations

Log and alert on outbound requests initiated from the Pivotick origin to untrusted destinations that could indicate session-token exfiltration.
Track anomalous authenticated API calls made shortly after users open shared notes or graphs.
Audit shared-content edit history for entries containing suspicious node-name payloads.

How to Mitigate CVE-2026-66921

Immediate Actions Required

Update Pivotick to a build that includes commit 4c13ff2b0ec769881b5526feddef37c0c5a08885 or later.
Route all Markdown-rendered output through DOMPurify or an equivalent sanitizer in every downstream consumer of the node-reference extension.
Review existing notes and graphs for stored payloads and remove or re-encode any node names containing HTML metacharacters.

Patch Information

The fix is available in the Pivotick GitHub commit 4c13ff2. It applies context-appropriate HTML escaping to nodeName before insertion into HTML text or quoted attribute values. The shared escapeHtml function now encodes ampersands, angle brackets, and both single and double quotation marks.

Workarounds

Deploy a strict Content Security Policy that forbids inline scripts and inline event handlers on pages rendering Pivotick Markdown.
Wrap all node-reference output with DOMPurify before injecting it into the DOM until the patched version is deployed.
Restrict write access to shared notes and graphs to trusted users to limit stored payload injection.

bash

# Example CSP header to block inline script execution from injected payloads
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; require-trusted-types-for 'script'