Improper URL Scheme Validation in Pivotick's Graph Data

CVE-2026-67173

What is CVE-2026-67173?

Pivotick exhibits a flaw in its handling of URL schemes for node imagePath values extracted from graph data. By failing to properly validate these values before assignment to SVG image resources, an attacker can exploit this oversight. If crafted graph data is loaded by a victim, it can set an image path to a malicious URI. This allows the attacker to initiate unintended requests or invoke scheme-specific actions within the victim's browser context. Consequently, the exploitation might expose limited client or network information, enable tracking, or even attempt to leverage access to local system resources. The fix normalizes whitespace and control characters in URI schemes while restricting legitimate image paths to relative URLs and specific protocols (http, https, data, and blob).

References