CVE-2026-67173: Pivotick SSRF Vulnerability

CVE-2026-67173 Overview

CVE-2026-67173 affects Pivotick, a graph visualization library that renders node data using Scalable Vector Graphics (SVG). The library did not validate the URL scheme of imagePath values sourced from graph data before assigning them to SVG image resources. An attacker who can supply crafted graph data can set an image path to a malicious Uniform Resource Identifier (URI). When a victim renders the affected graph, the browser resolves the attacker-controlled URI and may initiate an unintended request or trigger scheme-specific handling. This flaw is categorized as Server-Side Request Forgery [CWE-918].

Critical Impact
Exploitation can disclose limited client or network metadata, enable rendering-based tracking, or attempt access to local or internal resources depending on the URI and installed protocol handlers.

Affected Products

Pivotick graph visualization library
Applications embedding Pivotick's SVG NodeDrawer rendering component
Applications exposing Pivotick's PropertyList sidebar to untrusted graph data

Discovery Timeline

2026-07-28 - CVE-2026-67173 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67173

Vulnerability Analysis

The vulnerability resides in Pivotick's SVG renderer, specifically the NodeDrawer.ts component that assigns node imagePath values to SVG <image> elements. Because the renderer accepts any URI without scheme validation, an attacker controlling graph data can point image references to arbitrary destinations. The sidebar PropertyList.ts component shares the same weakness when rendering property values as clickable links. When the browser encounters these references during graph rendering, it dispatches network requests or invokes registered protocol handlers in the victim's execution context. Exploitation requires only that a victim load or render graph data containing the malicious imagePath.

Root Cause

The root cause is missing input validation on URI schemes for graph-derived image resources. The pre-patch code did not enforce an allowlist of safe schemes, permitting values such as javascript:, file:, or custom protocol handlers to reach the DOM. The patch introduces a hasAllowedScheme helper backed by SAFE_IMAGE_SCHEMES and SAFE_LINK_SCHEMES allowlists, and normalizes ASCII whitespace and control characters within URI schemes before comparison.

Attack Vector

The attack is network-based and requires user interaction to render the crafted graph. An attacker supplies a graph payload where a node's imagePath references an internal resource, a tracking endpoint, or a scheme handled by a local application. Because the request originates from the victim's browser, it can reach hosts reachable from the victim's network position, enabling Server-Side Request Forgery-style probing of internal services from the client.

typescript

// Security patch in src/renderers/svg/NodeDrawer.ts
 import { defaultLabelStyle } from '../../styles/defaults'
 import { resolveIcon, tryResolveNumber, tryResolveString } from '../../utils/Getters'
 import { parseSvgIconMarkup } from '../../utils/SvgSanitizer'
+import { hasAllowedScheme, SAFE_IMAGE_SCHEMES } from '../../utils/urlSafety'
 import type { CustomNodeShape, GraphRendererOptions, ImageFit, NodeShape, NodeStyle } from '../../interfaces/RendererOptions'
 import { ClusterDrawer } from './ClusterDrawer'
 import { forceConstrainParent } from '../../plugins/d3Forces/ForceConstrainParent'

// Security patch in src/ui/elements/Sidebar/PropertyList.ts
 import { checkmark, copy as copyIcon, externalLink } from '../../icons'
 import { createPrimitive } from '../../components/JsonViewer'
 import { escapeHtml } from '../../../utils/utils'
+import { hasAllowedScheme, SAFE_LINK_SCHEMES } from '../../../utils/urlSafety'
 import './properties.scss'

// Source: https://github.com/Pivotick/Pivotick/commit/2a6ad284e7ed69ab845087febe47f4cc82f13e1c

Detection Methods for CVE-2026-67173

Indicators of Compromise

Outbound HTTP requests from client browsers to internal or unexpected hosts triggered by rendered graph content
Graph data payloads containing imagePath fields with schemes other than http, https, data, or blob
SVG <image> elements whose href or xlink:href attributes resolve to file:, javascript:, or custom protocol handlers

Detection Strategies

Inspect graph data at ingestion boundaries and flag any node imagePath value that fails a scheme allowlist check
Monitor Content Security Policy (CSP) violation reports for img-src directive breaches originating from Pivotick views
Correlate browser-originated requests to internal IP ranges with recent graph rendering events in application telemetry

Monitoring Recommendations

Log all rendered graph payloads containing user-supplied imagePath values and route them through automated scheme validation
Alert on anomalous DNS resolutions from client endpoints that follow graph load events
Track requests to 169.254.169.254 and other cloud metadata endpoints originating from browser sessions

How to Mitigate CVE-2026-67173

Immediate Actions Required

Upgrade Pivotick to the version containing commit 2a6ad284e7ed69ab845087febe47f4cc82f13e1c
Audit stored graph data for imagePath values using unexpected URI schemes and remove or normalize them
Restrict which users or systems can submit graph data that will be rendered to other viewers

Patch Information

The fix is delivered in the Pivotick repository commit 2a6ad284e7ed69ab845087febe47f4cc82f13e1c. The patch introduces a hasAllowedScheme utility with SAFE_IMAGE_SCHEMES and SAFE_LINK_SCHEMES allowlists, normalizes ASCII whitespace and control characters in URI schemes, and restricts image paths to relative URLs or the http, https, data, and blob schemes. See the Pivotick GitHub Commit for full details.

Workarounds

Deploy a Content Security Policy that restricts img-src to https:, data:, and blob: sources on pages embedding Pivotick
Pre-process graph payloads server-side to strip or reject imagePath values whose scheme is not in the allowlist
Isolate the Pivotick renderer within an origin that has no network access to internal services

bash

# Example Content-Security-Policy header restricting SVG image sources
Content-Security-Policy: default-src 'self'; img-src 'self' https: data: blob:; connect-src 'self' https: