EUVD-2026-49795
GHSA-7473-f8wh-xmwc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8) · only source for this CVE.
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
2DescriptionCVE.org
Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers.
An attacker able to supply or modify graph data could insert a malicious HTML or JavaScript payload into a node’s label or description. The payload would be parsed and executed in the application’s origin when a user opened the affected node’s inspect or edit modal.
Successful exploitation could allow the attacker to access information available to the victim, modify application data, or perform actions using the victim’s active session.
The vulnerability has been addressed by creating the modal elements without embedding graph data in HTML and assigning node labels and descriptions through textContent.
AnalysisAI
Cross-site scripting in Pivotick's inspect and edit node modals allows attackers who can inject malicious node labels or descriptions into graph data to execute arbitrary JavaScript when a victim opens the affected modal. This can lead to theft of session cookies, sensitive information exposure, or unauthorized actions on behalf of the victim. The fix, available in a GitHub commit, switches from unsafe HTML interpolation to safe textContent assignment.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today