CVE-2026-67174: Pivotick DOM-Based XSS Vulnerability

CVE-2026-67174 Overview

CVE-2026-67174 is a DOM-based cross-site scripting (XSS) vulnerability in Pivotick's generic UI element resolution and icon-rendering utilities [CWE-79]. The tryResolveHTMLElement function assigned any resolved string to a <template> element through innerHTML, treating untrusted graph properties or rendering callback output as HTML markup. A second injection path exists in createIcon, which inserted caller-supplied svgIcon markup into a template without sanitization. An unauthenticated attacker who supplies a crafted graph, property value, rendering result, or SVG icon can execute JavaScript in another user's browser session.

Critical Impact
Successful exploitation allows attackers to access victim data, manipulate graph data or application state, and perform actions with the victim's privileges.

Affected Products

Pivotick (versions prior to commit 67c597c)
Applications integrating the Pivotick library and consuming untrusted graph or icon data
UI components including headers, property panels, extra panels, and tooltips

Discovery Timeline

2026-07-28 - CVE-2026-67174 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67174

Vulnerability Analysis

The vulnerability exists in two distinct code paths within Pivotick's UI utilities. The tryResolveHTMLElement function in src/utils/Getters.ts accepted string inputs and passed them directly to a <template> element via innerHTML. This behavior converted arbitrary strings into live DOM nodes, including <script> tags and event-handler attributes on SVG elements.

Multiple UI surfaces call this function, including header rendering, property panels, extra panels, and tooltips. Any of these components can trigger script execution when they display data derived from an attacker-controlled source.

The second path resides in createIcon, which accepts an svgIcon property and inserts it into the DOM without sanitization. Applications that derive icon markup from user-supplied data expose the same script-execution risk through a different entry point.

Root Cause

The root cause is unsafe use of innerHTML on untrusted string inputs. The library implicitly treated any string returned by a render callback or supplied as an SVG icon as trusted HTML. No sanitization stage existed between the caller-supplied string and the DOM insertion.

Attack Vector

An unauthenticated attacker delivers a crafted graph file, node property, edge property, custom render callback result, or svgIcon string. When the victim's browser renders the affected UI component, the injected markup parses into DOM nodes and executes JavaScript in the victim's origin.

typescript

// Patch excerpt: src/interfaces/GraphUI.ts
     * @default undefined
     * @example
     * (element) => `element id: ${element.id}`
+    * @remarks A returned `string` renders as plain text; return an `HTMLElement` to render HTML.
     */
     render?: ((element: Node | Edge | Node[] | Edge[] | null) => HTMLElement | string) | HTMLElement | string,
 }

Source: Pivotick security commit 67c597c

typescript

// Patch excerpt: src/utils/ElementCreation.ts
-import { tryResolveBoolean, tryResolveHTMLElement } from './Getters'
+import { tryResolveBoolean } from './Getters'
+import { parseSvgIconMarkup } from './SvgSanitizer'
 import type { Node } from '../Node'
 import type { Edge } from '../Edge'
 import type { Note } from '../Note'
 import { createButton } from '../ui/components/Button'
 import type { UIElement } from '../ui/UIManager'
-import type { IconClass, IconUnicode, ImagePath, MenuActionItemOptions, MenuQuickActionItemOptions, PropertyEntry, SVGIcon } from '../interfaces/GraphUI'
+import type { IconClass, IconUnicode, ImagePath, MenuActionItemOptions, MenuQuickActionItemOptions, SVGIcon } from '../interfaces/GraphUI'

Source: Pivotick security commit 67c597c. The patch removes the string-to-HTML resolution path and introduces parseSvgIconMarkup to sanitize SVG icon markup before DOM insertion.

Detection Methods for CVE-2026-67174

Indicators of Compromise

Graph files or API payloads containing HTML tags, <script> elements, or on* event handlers in node or edge property fields
SVG icon strings containing <script> tags, javascript: URIs, or event-handler attributes
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading a Pivotick view
Browser console errors referencing blocked resources triggered by injected markup

Detection Strategies

Audit application code for calls that pass untrusted data into Pivotick render callbacks, node properties, or svgIcon fields
Deploy a Content Security Policy (CSP) with script-src restrictions and monitor CSP violation reports for inline-script blocks originating from Pivotick UI components
Static analysis of dependency versions to flag builds using Pivotick releases prior to commit 67c597c

Monitoring Recommendations

Log and review any graph imports, shared workspace files, or user-generated content that reaches Pivotick rendering paths
Alert on browser telemetry showing DOM mutations that inject <script> or <iframe> elements into Pivotick container elements
Track user session anomalies such as unexpected privilege actions performed immediately after viewing shared graph content

How to Mitigate CVE-2026-67174

Immediate Actions Required

Upgrade Pivotick to a version that includes commit 67c597cdf7f6910f97a4c73905a7b845e0d039f1 or later
Review all integration points that pass user-controlled strings to render callbacks or svgIcon properties
Update integration code so render callbacks return an HTMLElement only when HTML output is required; return plain strings otherwise
Sanitize any SVG icon markup sourced from user-controlled data before passing it to Pivotick

Patch Information

The fix is available in the Pivotick repository as commit 67c597cdf7f6910f97a4c73905a7b845e0d039f1. The patch changes string rendering to use textContent, requiring callers to explicitly return an Element when HTML rendering is intended. It also introduces a parseSvgIconMarkup sanitizer that strips dangerous elements and attributes from SVG icon markup before DOM insertion. See the Pivotick security commit for the complete diff.

Workarounds

Restrict Pivotick usage to trusted graph sources until the patched version is deployed
Apply a strict Content Security Policy that blocks inline scripts and disallows unsafe event handlers
Wrap all render callback return values with a DOM sanitizer such as DOMPurify before returning them to Pivotick
Validate and sanitize SVG icon markup on the server side before storing or serving it to clients

bash

# Example: pin Pivotick to a patched revision in package.json
npm install github:Pivotick/Pivotick#67c597cdf7f6910f97a4c73905a7b845e0d039f1

# Example strict CSP header to reduce XSS impact
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'