CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing an excessively long path, deeply nested properties, or circular object references could therefore exhaust the JavaScript call stack when Pivotick calculates a layout or displays a node in the inspection modal. Successful exploitation may cause an uncaught exception, freeze the affected page, or crash the browser tab, resulting in a client-side denial of service. No confidentiality or integrity impact has been identified. The patch replaces the recursive graph traversals with iterative stack-based implementations and limits the reachability calculation to 1,000,000 edge traversals. It also limits JSON rendering to 64 levels and detects circular references before descending further into an object.

• CWE-400
• CWE-674

• https://github.com/Pivotick/Pivotick/commit/66373141eb7892fc29a3b42cfb2c160af16765fe

Published

Jul 28, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66913Lookyloo did not enforce limits on the decompressed size of …6.9
• CVE-2026-66914Joomla Extension - seblod.com - Unauthenticated path travers…9.2
• CVE-2026-66915Joomla Extension - fabrikar.com - Remote code execution in F…10
• CVE-2026-66918Pivotick fails to sanitize attacker-controlled SVG markup su…8.2
• CVE-2026-66919Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-6692The Slider Revolution plugin for WordPress is vulnerable to …8.8
• CVE-2026-66921Pivotick’s Markdown node-reference renderer failed to HTML-e…6.3
• CVE-2026-66922Pivotick used plain JavaScript objects as lookup tables inde…5.1
• CVE-2026-6694A flaw was found in GIMP's file-png plugin. A remote attacke…5.5
• CVE-2026-6695A flaw was found in GIMP. A remote attacker could exploit th…5.5
• CVE-2026-6696The Zingaya Click-to-Call plugin for WordPress is vulnerable…6.1
• CVE-2026-6700The DX Sources plugin for WordPress is vulnerable to Cross-S…4.3