CVE-2026-66919

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious HTML or JavaScript payload into a node’s label or description. The payload would be parsed and executed in the application’s origin when a user opened the affected node’s inspect or edit modal. Successful exploitation could allow the attacker to access information available to the victim, modify application data, or perform actions using the victim’s active session. The vulnerability has been addressed by creating the modal elements without embedding graph data in HTML and assigning node labels and descriptions through textContent.

• CWE-79

• https://github.com/Pivotick/Pivotick/commit/71d72d59234c65c423cb8d45eaa291a7b2a9b5e1

Published

Jul 28, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66909Apache CXF's JMS transport deserializes the body of any inbo…9.8
• CVE-2026-6691The MongoDB C Driver's Cyrus SASL integration performs unsaf…8.6
• CVE-2026-66913Lookyloo did not enforce limits on the decompressed size of …6.9
• CVE-2026-66914Joomla Extension - seblod.com - Unauthenticated path travers…9.2
• CVE-2026-66915Joomla Extension - fabrikar.com - Remote code execution in F…10
• CVE-2026-66918Pivotick fails to sanitize attacker-controlled SVG markup su…8.2
• CVE-2026-6692The Slider Revolution plugin for WordPress is vulnerable to …8.8
• CVE-2026-66920Pivotick contains an uncontrolled-recursion vulnerability wh…8.2
• CVE-2026-66921Pivotick’s Markdown node-reference renderer failed to HTML-e…6.3
• CVE-2026-66922Pivotick used plain JavaScript objects as lookup tables inde…5.1
• CVE-2026-6694A flaw was found in GIMP's file-png plugin. A remote attacke…5.5
• CVE-2026-6695A flaw was found in GIMP. A remote attacker could exploit th…5.5