CVE-2026-66825

Received Received - Intake

XSS in Pivotick Sidebar Property-List Component

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence node or edge property data could provide a malicious value using the javascript: scheme, including variants obfuscated with whitespace or control characters. If a user clicked the generated property link, attacker-controlled JavaScript could execute in the context of the Pivotick application. Successful exploitation could allow the attacker to access information available to the victim’s browser session or perform actions with the victim’s privileges. The vulnerability was addressed by normalizing property values and preventing URLs with non-allowlisted schemes from being rendered as clickable links.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-66825

EUVD

EUVD-2026-49464

Affected Vendors & Products

Vendor	Product	Version / Range
pivotick	pivotick	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Pivotick has a cross-site scripting vulnerability in its sidebar property-list component. It allows rendering values for link-like properties such as url or href without validating the URL scheme. Attackers can exploit this by providing malicious javascript: URLs, which execute JavaScript when clicked. The application now normalizes property values and blocks non-allowlisted URL schemes.

Detection Guidance

To detect this vulnerability, inspect Pivotick applications for property values using javascript: or similar schemes in link-like properties (url, uri, href, etc.). Check browser console logs for executed scripts from untrusted sources. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could let an attacker run malicious JavaScript in your browser session within the Pivotick application. This may allow them to steal your session data or perform actions as you, potentially accessing sensitive information or modifying settings.

Mitigation Strategies

Update Pivotick to the latest version where the issue is addressed. Sanitize property values to block non-allowlisted URL schemes. Restrict user input to trusted sources and validate all URLs before rendering.

Hi! I’m here to help you understand CVE-2026-66825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70