CVE-2026-66918
Received Received - Intake

XSS in Pivotick via SVG Icon Markup

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker able to influence graph data can provide crafted markup containing executable event handlers, such as an <image> element with an onerror attribute. When a victim loads or renders the malicious graph, the payload may execute arbitrary JavaScript in the security context of the application embedding Pivotick. Successful exploitation could allow the attacker to access application data available to the victim, modify displayed content, or perform actions using the victim’s authenticated session. Exploitation requires an application using Pivotick to render graph data that is controlled or modified by an attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66918
EUVD
EUVD-2026-49792

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pivotick pivotick *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Pivotick fails to sanitize SVG markup provided through the style.svgIcon property before inserting it into the document. When rendering a graph node, the SVG icon markup is assigned directly to the innerHTML of an SVG element. Attackers can inject crafted SVG with executable event handlers like an image element with an onerror attribute. This allows arbitrary JavaScript execution in the application's security context when a victim loads the malicious graph.

Detection Guidance

Check if your Pivotick application uses untrusted SVG icons by inspecting graph data for nodes with style.svgIcon properties containing executable event handlers like onerror attributes. Review server logs for unusual SVG content in graph data.

Impact Analysis

An attacker could access sensitive application data available to the victim, modify displayed content, or perform actions using the victim's authenticated session. Exploitation requires the victim to load or render a graph controlled or modified by the attacker.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles and HIPAA's security requirements for protected health information. The risk of arbitrary JavaScript execution in the application context could result in data breaches, unauthorized modifications, or session hijacking, all of which are critical compliance concerns.

Mitigation Strategies

Update Pivotick to the latest version that includes the sanitization fix for style.svgIcon. If updating is not possible, implement DOMPurify or similar sanitization for SVG markup before rendering. Remove any untrusted SVG icons from graph data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart