Cross-Site Scripting Vulnerability in Pivotick by Pivotick Technologies

CVE-2026-66919

What is CVE-2026-66919?

Pivotick has a cross-site scripting vulnerability that arises from the improper handling of node labels and descriptions within modal interfaces. An attacker capable of altering graph data can inject malicious HTML or JavaScript into the node's label or description. This vulnerability enables the execution of the payload within the application’s origin when users open the inspect or edit modal for the affected node. This exploitation can potentially allow attackers to access sensitive information, manipulate application data, or conduct actions on behalf of the user utilizing the compromised active session. The issue has been resolved by redesigning the modal elements to avoid embedding graph data directly in the HTML structure, utilizing 'textContent' to safely assign node labels and descriptions.

References