Uncontrolled Recursion Vulnerability in Pivotick by Pivotick

CVE-2026-66920

What is CVE-2026-66920?

Pivotick is prone to an uncontrolled-recursion vulnerability when handling caller-supplied graph and node data. This arises from the recursive traversal of graph edges and the processing of deeply nested properties in the JSON viewer. Attackers can exploit this vulnerability by supplying specially crafted graphs, leading to excessive recursion that exhausts the JavaScript call stack. This can cause significant disruptions such as page freezes or browser tab crashes, resulting in a client-side denial of service. The patch implemented by Pivotick addresses this issue by replacing recursive graph traversals with iterative methods, limiting edge traversals, and incorporating measures to prevent circular reference processing.

References