CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or __proto__, were not handled as ordinary identifiers. These values could be interpreted as existing inherited properties, resolve to values of an unexpected type, or—in the case of __proto__ assignments—modify the prototype of an internal lookup object. An attacker who can supply graph data containing crafted node identifiers could consequently cause nodes or edges to be silently omitted, produce incorrect hierarchy levels, bypass or corrupt cycle-detection results, or trigger an exception that interrupts graph processing and rendering. This affects the integrity of graph visualisations and analytics and may cause a client-side denial-of-service condition. The affected code also failed to safely handle edges whose source node was absent from the supplied node set. Furthermore, calculating the maximum tree depth by spreading all level values into Math.max() could exceed the JavaScript function-argument limit when processing a sufficiently large graph, resulting in an exception and denial of service. The patch replaces identifier-keyed plain objects with Map instances, ignores invalid edges during tree construction, and calculates the maximum depth iteratively.

• CWE-1321

• https://github.com/Pivotick/Pivotick/commit/4e12922627029af77476c6f1ab8a14e98d5ef451

Published

Jul 28, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66915Joomla Extension - fabrikar.com - Remote code execution in F…10
• CVE-2026-66918Pivotick fails to sanitize attacker-controlled SVG markup su…8.2
• CVE-2026-66919Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-6692The Slider Revolution plugin for WordPress is vulnerable to …8.8
• CVE-2026-66920Pivotick contains an uncontrolled-recursion vulnerability wh…8.2
• CVE-2026-66921Pivotick’s Markdown node-reference renderer failed to HTML-e…6.3
• CVE-2026-6694A flaw was found in GIMP's file-png plugin. A remote attacke…5.5
• CVE-2026-6695A flaw was found in GIMP. A remote attacker could exploit th…5.5
• CVE-2026-6696The Zingaya Click-to-Call plugin for WordPress is vulnerable…6.1
• CVE-2026-6700The DX Sources plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2026-6701The addfreespace plugin for WordPress is vulnerable to Cross…4.3
• CVE-2026-6702The Publish 2 Ping.fm plugin for WordPress is vulnerable to …6.1