Pivotick
Monthly
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to inject malicious URIs that trigger unintended browser requests and limited metadata disclosure when a victim renders crafted graph data. The vulnerability requires victim interaction to load the malicious graph, and no authentication is needed. No public exploit is identified at time of analysis; a vendor patch is available.
Processing specially crafted graph data in Pivotick can lead to unreliable visualizations, corrupted cycle detection, and client-side denial-of-service. An attacker can craft node identifiers that collide with Object.prototype properties ('constructor', 'toString', '__proto__'), causing prototype pollution and logic errors. No known active exploitation or public exploit code exists, but the vulnerability is trivially triggered by user interaction.
Stored cross-site scripting in Pivotick’s Markdown node-reference renderer allows JavaScript execution when a victim opens a crafted graph or note. The root cause is missing HTML escaping of attacker-controlled node names before interpolation into HTML attributes and element bodies. A patch is available from the vendor; no public exploit or active exploitation has been reported.
Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to inject malicious URIs that trigger unintended browser requests and limited metadata disclosure when a victim renders crafted graph data. The vulnerability requires victim interaction to load the malicious graph, and no authentication is needed. No public exploit is identified at time of analysis; a vendor patch is available.
Processing specially crafted graph data in Pivotick can lead to unreliable visualizations, corrupted cycle detection, and client-side denial-of-service. An attacker can craft node identifiers that collide with Object.prototype properties ('constructor', 'toString', '__proto__'), causing prototype pollution and logic errors. No known active exploitation or public exploit code exists, but the vulnerability is trivially triggered by user interaction.
Stored cross-site scripting in Pivotick’s Markdown node-reference renderer allows JavaScript execution when a victim opens a crafted graph or note. The root cause is missing HTML escaping of attacker-controlled node names before interpolation into HTML attributes and element bodies. A patch is available from the vendor; no public exploit or active exploitation has been reported.
Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.