Executive brief
Pivotick, a tool used for managing notes and graphs, contains a security flaw in how it handles Markdown references. An attacker can create a specially crafted note that, when viewed by another user, executes malicious code in their web browser. This could allow the attacker to steal session information, access private data, or perform actions on behalf of the victim.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Pivotick's Markdown node-reference renderer due to improper neutralization of the 'nodeName' value. The node-reference tokenizer failed to escape HTML metacharacters such as quotation marks and angle brackets, allowing an attacker to terminate attributes or inject arbitrary HTML elements and event handlers. If the rendered content is processed by a consumer without secondary sanitization (like DOMPurify), arbitrary JavaScript can execute in the victim's browser context. The vulnerability is addressed in commit 4c13ff2 by implementing a context-aware escaping function that handles ampersands, angle brackets, and quotes.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory