Executive brief
Pivotick is a graph visualization and analytics tool. A vulnerability in how it processes graph data allows an attacker to provide specially crafted node names (like "__proto__") to corrupt the internal logic of the application. This can lead to incorrect data being displayed, missing information in charts, or the application crashing entirely for the user.
Technical details
Pivotick (up to version 1.4.0) uses plain JavaScript objects as lookup tables for graph node identifiers in its tree-layout and cycle-detection components. Because these objects are indexed by caller-controlled strings, identifiers matching inherited properties (e.g., 'constructor', '__proto__') can cause prototype pollution or logic bypasses, such as omitting nodes or corrupting cycle detection. Additionally, the library is susceptible to a client-side denial-of-service via a stack overflow when calculating tree depth using Math.max(...spread) on large datasets. The vulnerability is fixed by migrating to Map instances for lookups and using iterative depth calculations.
Affected products
- Pivotick Pivotick <= 1.4.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched: Fixed in commit 4e12922627029af77476c6f1ab8a14e98d5ef451