# CVE-2026-66918: Pivotick XSS in node style.svgIcon property

Source: https://junglewise.ai/threats/cve-2026-66918-pivotick-xss-in-node-style-svgicon-property  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-66918 · Severity: info · CVSS 8.2 · Published 2026-07-28

Pivotick, a graph rendering library, contains a security flaw that fails to properly clean data before displaying it. If an attacker can influence the graph data being displayed, they can execute malicious scripts in the browser of a user viewing the graph. This could lead to the theft of sensitive application data, unauthorized actions performed in the user's session, or the modification of displayed information.

Technologies: [Pivotick](https://junglewise.ai/threats/technologies/pivotick). Vendors: [Pivotick](https://junglewise.ai/threats/vendors/pivotick).

## Quick answers

**Is CVE-2026-66918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66918 being exploited in the wild.

**How severe is CVE-2026-66918?** Informational severity, with a CVSS score of 8.2, published 28 July 2026.

**Which products and versions are affected?** Pivotick <= 1.4.0.

**Is there a fix for CVE-2026-66918?** A patch was published on 2026-07-28: Fixed in commit 8dbfe4ca3582e715535d261535a0d632ce271dea Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66918 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66918?** Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Pivotick due to improper neutralization of input during web page generation (CWE-79). The vulnerable code in NodeDrawer.ts assigns SVG icon markup from the 'style.svgIcon' property directly to the innerHTML property of a live SVG element without sanitization. An attacker who can control or modify graph data can inject malicious SVG markup containing event handlers, such as an <image> tag with an 'onerror' attribute. When a victim renders the affected graph, the payload executes arbitrary JavaScript in the application's security context. A fix has been identified in a commit that introduces an SvgSanitizer utility to clean the markup before it reaches the DOM.

## Affected products

- Pivotick Pivotick <= 1.4.0

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in commit 8dbfe4ca3582e715535d261535a0d632ce271dea

## References

- [https://github.com/Pivotick/Pivotick/commit/8dbfe4ca3582e715535d261535a0d632ce271dea](https://github.com/Pivotick/Pivotick/commit/8dbfe4ca3582e715535d261535a0d632ce271dea)

## Related threats

- [Pivotick DOM-based XSS in UI element and icon rendering](https://junglewise.ai/threats/cve-2026-67174-pivotick-dom-based-xss-in-ui-element-and-icon-rendering)
- [Pivotick SSRF via unvalidated node imagePath URL schemes](https://junglewise.ai/threats/cve-2026-67173-pivotick-ssrf-via-unvalidated-node-imagepath-url-schemes)
- [Pivotick prototype pollution and DoS in graph processing](https://junglewise.ai/threats/cve-2026-66922-pivotick-prototype-pollution-and-dos-in-graph-processing)
- [Pivotick Markdown node-reference renderer cross-site scripting](https://junglewise.ai/threats/cve-2026-66921-pivotick-markdown-node-reference-renderer-cross-site-scripting)
- [Pivotick uncontrolled recursion in graph and node processing](https://junglewise.ai/threats/cve-2026-66920-pivotick-uncontrolled-recursion-in-graph-and-node-processing)