Quick answers
- Is CVE-2026-66920 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66920 being exploited in the wild.
- How severe is CVE-2026-66920?
- Informational severity, with a CVSS score of 8.2, published 28 July 2026.
- Which products and versions are affected?
- Pivotick <= 1.4.0.
- Is there a fix for CVE-2026-66920?
- A patch was published on 2026-07-28: Fixed in commit 6637314 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66920 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-66920?
- Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Pivotick is vulnerable to uncontrolled recursion (CWE-674) within its graph layout algorithms and JSON inspection modal. The `hasCycle`, `findMaxReachabilityRoot`, and `JsonViewer` components recursively traversed graph edges and data levels without depth limits or circular reference checks. An attacker providing a specially crafted graph with excessively long paths, deeply nested properties, or circular object references can exhaust the JavaScript call stack. This results in an uncaught exception, browser tab freeze, or crash (client-side DoS). The vulnerability was addressed in the commit `6637314` by implementing iterative stack-based traversals, capping reachability calculations at 1,000,000 edges, and limiting JSON rendering to 64 levels.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched: Fixed in commit 6637314
- 2026-07-28: advisory