CVE-2026-66921
Received Received - Intake

XSS in Pivotick Markdown Node-Renderer

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference tokenizer rejected only square brackets, a crafted node name could still contain quotation marks, angle brackets, or other HTML metacharacters. An attacker could therefore terminate the quoted attribute or inject additional HTML elements and event-handler attributes. When malicious node-reference content is rendered by a consumer that does not apply DOMPurify or equivalent sanitization, arbitrary JavaScript may execute in the victim’s browser in the security context of the application. Successful exploitation requires a victim to open or render a crafted graph or note and could allow the attacker to access same-origin information, modify displayed content, or perform actions using the victim’s session. The patch resolves the issue by applying context-appropriate HTML escaping to node names before inserting them into either HTML text or quoted attribute values. The shared escaping function now encodes ampersands, angle brackets, and both types of quotation marks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66921
EUVD
EUVD-2026-49844

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pivotick pivotick *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Pivotick's Markdown node-reference renderer did not properly escape attacker-controlled nodeName values before inserting them into HTML attributes and element bodies. This allowed injection of HTML metacharacters like quotes and angle brackets, enabling cross-site scripting (XSS) attacks if consumers did not use sanitization tools like DOMPurify.

Detection Guidance

This vulnerability is specific to the Markdown node-reference renderer in Pivotick's software. Detection requires checking if the affected version of the renderer is present and if user-controlled node names are being improperly escaped. Inspect HTML output for unescaped node names in attributes or element bodies. No direct network commands exist; focus on code review and output validation.

Impact Analysis

If you view or render a crafted graph or note, an attacker could execute arbitrary JavaScript in your browser session. This may let them steal same-origin data, modify displayed content, or perform actions on your behalf without your knowledge.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information. Organizations may face compliance failures if exploited.

Mitigation Strategies
  • Update to the patched version of Pivotick's software that includes the new escapeHtml function.
  • Ensure all consumers of the renderer apply DOMPurify or equivalent sanitization to HTML output.
  • Review and validate that node names are properly escaped in both HTML attributes and text contexts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart