EUVD-2026-49464
GHSA-8cp5-fq7r-3vq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
User interaction required (clicking link); no privileges; low CIA impact; scope unchanged.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
2DescriptionCVE.org
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme.
An attacker able to supply or influence node or edge property data could provide a malicious value using the javascript: scheme, including variants obfuscated with whitespace or control characters. If a user clicked the generated property link, attacker-controlled JavaScript could execute in the context of the Pivotick application.
Successful exploitation could allow the attacker to access information available to the victim’s browser session or perform actions with the victim’s privileges. The vulnerability was addressed by normalizing property values and preventing URLs with non-allowlisted schemes from being rendered as clickable links.
AnalysisAI
Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.
Technical ContextAI
Pivotick is a graph visualization tool that displays node and edge properties in a sidebar component. The vulnerability (CWE-79) occurs in the PropertyList component, where property values named like 'url', 'uri', 'href', 'link', 'website', or 'homepage' are rendered as hyperlinks without validating the URL scheme. The commit 84ddc064d53e9e20cce4077d1192bfdb3aecf17b adds a hasUnsafeScheme() function that normalizes the value (stripping ASCII control/whitespace characters to handle obfuscation like java\tscript:) and checks against an allowlist of safe URL schemes (via ABSOLUTE_URL regex). The CPE cpe:2.3:a:pivotick:pivotick:* indicates all versions are affected.
RemediationAI
Apply the vendor patch by upgrading to the version including commit 84ddc064d53e9e20cce4077d1192bfdb3aecf17b (or later). As a workaround, disable the property-list feature if not critical, or sanitize user-supplied graph data to strip javascript: and other dangerous URL schemes before rendering. Note that the patch normalizes property values server-side and prevents rendering of unsafe links, which is the recommended and durable fix. No unpatched alternative configuration exists.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON
Stored cross-site scripting in Pivotick’s Markdown node-reference renderer allows JavaScript execution when a victim ope
Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to injec
Processing specially crafted graph data in Pivotick can lead to unreliable visualizations, corrupted cycle detection, an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today