Quick answers
- Is CVE-2026-66918 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66918 being exploited in the wild.
- How severe is CVE-2026-66918?
- Informational severity, with a CVSS score of 8.2, published 28 July 2026.
- Which products and versions are affected?
- Pivotick <= 1.4.0.
- Is there a fix for CVE-2026-66918?
- A patch was published on 2026-07-28: Fixed in commit 8dbfe4ca3582e715535d261535a0d632ce271dea Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66918 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-66918?
- Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Pivotick due to improper neutralization of input during web page generation (CWE-79). The vulnerable code in NodeDrawer.ts assigns SVG icon markup from the 'style.svgIcon' property directly to the innerHTML property of a live SVG element without sanitization. An attacker who can control or modify graph data can inject malicious SVG markup containing event handlers, such as an <image> tag with an 'onerror' attribute. When a victim renders the affected graph, the payload executes arbitrary JavaScript in the application's security context. A fix has been identified in a commit that introduces an SvgSanitizer utility to clean the markup before it reaches the DOM.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in commit 8dbfe4ca3582e715535d261535a0d632ce271dea