Read the docs
TI-2026-47487 Aliases CVE-2026-66918GHSA-xp42-qr2q-c463

DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker able to influence graph data can provide crafted markup containing executable event handlers, such as an <image> element with an onerror attribute. When a victim loads or renders the malicious graph, the payload may execute arbitrary JavaScript in the security context of the application embedding Pivotick. Successful exploitation could allow the attacker to access application data available to the victim, modify displayed content, or perform actions using the victim’s authenticated session. Exploitation requires an application using Pivotick to render graph data that is controlled or modified by an attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pivotickpivotickup to 1.4.0—No fix listedCNA
  • pivotick Vendorpivotick Affected up to 1.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66918
  2. 2026-10-03 Alias added: GHSA-xp42-qr2q-c463

References

Patch 1

  • TI-2026-47504 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick CVSS 4.0CRITICAL 9.2
  • TI-2026-47489 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data CVSS 4.0HIGH 8.2
  • TI-2026-47488 Stored DOM-Based Cross-Site Scripting in Node Modal Headers CVSS 4.0MEDIUM 6.9
  • TI-2026-47456 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links CVSS 4.0MEDIUM 6.9
  • TI-2026-47490 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References CVSS 4.0MEDIUM 6.3
  • TI-2026-47503 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences