Pivotick EUVD-2026-49796

Q: What is the CVSS score of EUVD-2026-49796?

EUVD-2026-49796 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-66920 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-28 5a6e4751-2f3f-4070-9419-94fb35b644e8

GHSA-cgxr-m8cj-3q4w

Denial Of Service

8.2

CVSS 4.0 · Vendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Severity by source

Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Requires user interaction (UI:R), no privilege or complexity, only availability impact (A:H), no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).

CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 13:31 vuln.today

Analysis Generated

Jul 28, 2026 - 13:31 vuln.today

CVE Published

Jul 28, 2026 - 13:19 cve.org

HIGH 8.2

DescriptionCVE.org

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing an excessively long path, deeply nested properties, or circular object references could therefore exhaust the JavaScript call stack when Pivotick calculates a layout or displays a node in the inspection modal.

Successful exploitation may cause an uncaught exception, freeze the affected page, or crash the browser tab, resulting in a client-side denial of service. No confidentiality or integrity impact has been identified.

The patch replaces the recursive graph traversals with iterative stack-based implementations and limits the reachability calculation to 1,000,000 edge traversals. It also limits JSON rendering to 64 levels and detects circular references before descending further into an object.

AnalysisAI

Uncontrolled recursion in Pivotick's graph traversal and JSON viewer allows remote attackers to crash the user's browser tab by supplying crafted graph data with long paths, deep nesting, or circular references. No confidentiality or integrity impact exists - only client-side denial of service. A patch replaces recursive algorithms with iterative implementations and adds depth/cycle guards.

Technical ContextAI

The vulnerability is in the JavaScript-based Pivotick application, affecting two subsystems: DAGAlgorithms.ts (for graph reachability and cycle detection) and JsonViewer.ts (for rendering node data in an inspection modal). Both components used recursive functions without depth or cycle checks, leading to uncontrolled call-stack consumption (CWE-400). The CPE data is not provided, but the commit fixes the src/plugins/analytics/ and src/ui/components/ paths. Graph algorithms traversed edges recursively; the JSON viewer recursively rendered object properties.

RemediationAI

Apply the vendor-supplied patch by updating to a build containing commit 66373141eb7892fc29a3b42cfb2c160af16765fe or later. Until an update is possible, avoid loading untrusted graph data into Pivotick; this completely mitigates the exploitation path. Note that disabling the analytics or JSON viewer features is not practical as a workaround without source modification.