Executive brief
Pivotick, a graph visualization tool, contains a security flaw in how it displays node information. If an attacker provides or modifies graph data with malicious code, that code will execute in the browser of any user who views or edits that specific node. This could allow an attacker to steal sensitive information from the user's session or perform unauthorized actions on their behalf.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Pivotick versions up to and including 1.4.0. The root cause is the direct interpolation of 'data.label' and 'data.description' from graph data into the innerHTML of modal headers within 'InspectNodeModal.ts' and 'EditNodeModal.ts'. An attacker who can supply or modify the underlying graph data can inject malicious JavaScript. The payload executes when a victim opens the affected node's inspect or edit modal. The issue has been patched in later commits by switching from HTML interpolation to using 'textContent' for rendering these fields.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched: Fixed in commit 71d72d59234c65c423cb8d45eaa291a7b2a9b5e1