Vulnerabilities

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities.

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources.

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components.

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element.

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data.

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals.

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document.

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component.