Executive brief
Pivotick, a graph visualization tool, is vulnerable to a flaw that can crash a user's web browser or cause the application to freeze. This occurs when the software attempts to process specially crafted data containing extremely complex or circular relationships. An attacker could exploit this to disrupt service for users viewing malicious or overly complex graph data.
Technical details
Pivotick is vulnerable to uncontrolled recursion (CWE-674) within its graph layout algorithms and JSON inspection modal. The `hasCycle`, `findMaxReachabilityRoot`, and `JsonViewer` components recursively traversed graph edges and data levels without depth limits or circular reference checks. An attacker providing a specially crafted graph with excessively long paths, deeply nested properties, or circular object references can exhaust the JavaScript call stack. This results in an uncaught exception, browser tab freeze, or crash (client-side DoS). The vulnerability was addressed in the commit `6637314` by implementing iterative stack-based traversals, capping reachability calculations at 1,000,000 edges, and limiting JSON rendering to 64 levels.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched: Fixed in commit 6637314
- 2026-07-28: advisory