CVE-2026-67174
Pivotick, a graph visualization library, has a critical DOM-based cross‑site scripting flaw that lets attackers inject malicious HTML or SVG into its user interface. The vulnerability arises when untrusted data is rendered as HTML or inserted as an icon without proper sanitization. A vendor patch replaces unsafe innerHTML usage with textContent and sanitizes SVG icons.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Pivotick users who incorporate untrusted graph data or custom rendering callbacks are affected. The flaw exists in the library’s generic UI element resolution and icon‑rendering utilities.
Real-world impact
An attacker can run arbitrary JavaScript in a victim’s browser, steal sensitive information, modify graph data or application state, and perform actions with the victim’s privileges.
Why this severity
The CVSS score of 9.2 reflects that the flaw is remotely exploitable without authentication, allows arbitrary code execution in the victim’s browser, and has a high impact on confidentiality and integrity.
What to do about it
- 01Apply the vendor patch that updates tryResolveHTMLElement to use textContent instead of innerHTML and sanitizes SVG icon markup.
- 02Restart the Pivotick application to ensure the patch is in effect.
- ›Avoid using untrusted data for graph properties or custom rendering callbacks until the patch is applied.
NVD description
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.