# CVE-2026-66922: Pivotick prototype pollution and DoS in graph processing

Source: https://junglewise.ai/threats/cve-2026-66922-pivotick-prototype-pollution-and-dos-in-graph-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-66922 · Severity: info · CVSS 5.1 · Published 2026-07-28

Pivotick is a graph visualization and analytics tool. A vulnerability in how it processes graph data allows an attacker to provide specially crafted node names (like "__proto__") to corrupt the internal logic of the application. This can lead to incorrect data being displayed, missing information in charts, or the application crashing entirely for the user.

Technologies: [Pivotick](https://junglewise.ai/threats/technologies/pivotick). Vendors: [Pivotick](https://junglewise.ai/threats/vendors/pivotick).

## Quick answers

**Is CVE-2026-66922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66922 being exploited in the wild.

**How severe is CVE-2026-66922?** Informational severity, with a CVSS score of 5.1, published 28 July 2026.

**Which products and versions are affected?** Pivotick <= 1.4.0.

**Is there a fix for CVE-2026-66922?** A patch was published on 2026-07-28: Fixed in commit 4e12922627029af77476c6f1ab8a14e98d5ef451 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66922 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66922?** Check whether you run Pivotick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Pivotick (up to version 1.4.0) uses plain JavaScript objects as lookup tables for graph node identifiers in its tree-layout and cycle-detection components. Because these objects are indexed by caller-controlled strings, identifiers matching inherited properties (e.g., 'constructor', '__proto__') can cause prototype pollution or logic bypasses, such as omitting nodes or corrupting cycle detection. Additionally, the library is susceptible to a client-side denial-of-service via a stack overflow when calculating tree depth using Math.max(...spread) on large datasets. The vulnerability is fixed by migrating to Map instances for lookups and using iterative depth calculations.

## Affected products

- Pivotick Pivotick <= 1.4.0

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: patched: Fixed in commit 4e12922627029af77476c6f1ab8a14e98d5ef451

## References

- [https://github.com/Pivotick/Pivotick/commit/4e12922627029af77476c6f1ab8a14e98d5ef451](https://github.com/Pivotick/Pivotick/commit/4e12922627029af77476c6f1ab8a14e98d5ef451)

## Related threats

- [Pivotick DOM-based XSS in UI element and icon rendering](https://junglewise.ai/threats/cve-2026-67174-pivotick-dom-based-xss-in-ui-element-and-icon-rendering)
- [Pivotick SSRF via unvalidated node imagePath URL schemes](https://junglewise.ai/threats/cve-2026-67173-pivotick-ssrf-via-unvalidated-node-imagepath-url-schemes)
- [Pivotick Markdown node-reference renderer cross-site scripting](https://junglewise.ai/threats/cve-2026-66921-pivotick-markdown-node-reference-renderer-cross-site-scripting)
- [Pivotick uncontrolled recursion in graph and node processing](https://junglewise.ai/threats/cve-2026-66920-pivotick-uncontrolled-recursion-in-graph-and-node-processing)
- [Pivotick Cross-Site Scripting in Node Modals](https://junglewise.ai/threats/cve-2026-66919-pivotick-cross-site-scripting-in-node-modals)