Quick answers
- Is CVE-2026-66825 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66825 being exploited in the wild.
- How severe is CVE-2026-66825?
- Informational severity, with a CVSS score of 6.9, published 27 July 2026.
- Which products and versions are affected?
- Pivotick < 1.4.0.
- Is there a fix for CVE-2026-66825?
- A patch was published on 2026-07-27: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66825 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-66825?
- Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Pivotick's sidebar property-list component. The application fails to validate URL schemes for properties such as 'url', 'href', or 'website', allowing the use of the 'javascript:' pseudo-protocol. An attacker who can supply or influence node or edge property data can inject malicious JavaScript, including variants obfuscated with control characters. When a user clicks the generated link, the script executes in the context of the victim's browser session. The issue is resolved in version 1.4.0 by implementing an allowlist for URL schemes and normalizing property values.
Affected products
- Pivotick Pivotick < 1.4.0
Timeline
- 2026-07-27: advisory: CVE-2026-66825 published
- 2026-07-27: patched: Fix committed to GitHub repository