Tree-Layout and Cycle-Detection Vulnerability in Pivotick by Pivotick

CVE-2026-66922

What is CVE-2026-66922?

The Pivotick library is susceptible to exploitation due to improper handling of user-controlled graph node identifiers in its tree-layout and cycle-detection components. Attackers can craft node identifiers that conflict with properties from the Object.prototype, leading to potential data integrity issues, like silent omission of nodes or edges, and faulty cycle-detection results. This exploitation not only risks incorrect visualizations but may also initiate exceptions that disrupt graph processing, ultimately resulting in client-side denial of service. The vulnerability is exacerbated by challenges in handling edges for absent nodes and can cause significant performance issues when calculating maximum tree depth using large datasets. A recent patch addresses these concerns by using Map instances for identifier storage and implementing safer edge construction practices.

References