CVE-2026-66922
Received Received - Intake

Prototype Pollution in Pivotick Graph Components

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or __proto__, were not handled as ordinary identifiers. These values could be interpreted as existing inherited properties, resolve to values of an unexpected type, or—in the case of __proto__ assignments—modify the prototype of an internal lookup object. An attacker who can supply graph data containing crafted node identifiers could consequently cause nodes or edges to be silently omitted, produce incorrect hierarchy levels, bypass or corrupt cycle-detection results, or trigger an exception that interrupts graph processing and rendering. This affects the integrity of graph visualisations and analytics and may cause a client-side denial-of-service condition. The affected code also failed to safely handle edges whose source node was absent from the supplied node set. Furthermore, calculating the maximum tree depth by spreading all level values into Math.max() could exceed the JavaScript function-argument limit when processing a sufficiently large graph, resulting in an exception and denial of service. The patch replaces identifier-keyed plain objects with Map instances, ignores invalid edges during tree construction, and calculates the maximum depth iteratively.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66922
EUVD
EUVD-2026-49845

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pivotick pivotick *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of node identifiers in Pivotick's tree-layout and cycle-detection components. The code used plain JavaScript objects as lookup tables for node IDs, which allowed prototype pollution attacks. Attackers could use node IDs like constructor, toString, or __proto__ to manipulate the prototype chain, causing nodes or edges to be omitted, incorrect hierarchy levels, or corrupted cycle detection. This could lead to incorrect graph visualizations, analytics errors, or client-side denial-of-service conditions.

Detection Guidance

This vulnerability is specific to the Pivotick library's handling of graph node identifiers. Detection requires checking if your application uses Pivotick versions prior to the patched commit 4e12922627029af77476c6f1ab8a14e98d5ef451. Inspect package.json for Pivotick dependencies and verify the commit hash in the library's source code.

Impact Analysis

An attacker could exploit this to disrupt graph processing, causing incorrect visualizations or analytics. This might lead to misinformation, system crashes, or denial-of-service conditions. Additionally, prototype pollution could allow further attacks if the affected system processes untrusted graph data.

Compliance Impact

This vulnerability primarily impacts data integrity and availability in graph visualizations and analytics. While it does not directly violate GDPR or HIPAA, it could lead to incorrect data processing or denial-of-service conditions, which may indirectly affect compliance by compromising the accuracy and reliability of systems handling sensitive data.

Mitigation Strategies

Update Pivotick to the patched version that replaces plain JavaScript objects with Map instances for node-id lookups. Review graph data processing to ensure node identifiers do not include prototype properties like __proto__ or constructor. Validate edge sources exist in the node set before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart