Read the docs
TI-2026-47488 Aliases CVE-2026-66919GHSA-7473-f8wh-xmwc

Stored DOM-Based Cross-Site Scripting in Node Modal Headers

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious HTML or JavaScript payload into a node’s label or description. The payload would be parsed and executed in the application’s origin when a user opened the affected node’s inspect or edit modal. Successful exploitation could allow the attacker to access information available to the victim, modify application data, or perform actions using the victim’s active session. The vulnerability has been addressed by creating the modal elements without embedding graph data in HTML and assigning node labels and descriptions through textContent.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pivotickPivotickup to 1.4.0—No fix listedCNA
  • Pivotick Vendorpivotick Affected up to 1.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66919
  2. 2026-10-03 Alias added: GHSA-7473-f8wh-xmwc

References

Patch 1

  • TI-2026-47504 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick CVSS 4.0CRITICAL 9.2
  • TI-2026-47489 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data CVSS 4.0HIGH 8.2
  • TI-2026-47487 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons CVSS 4.0HIGH 8.2
  • TI-2026-47456 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links CVSS 4.0MEDIUM 6.9
  • TI-2026-47490 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References CVSS 4.0MEDIUM 6.3
  • TI-2026-47503 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences