XSS in Pivotick
CVE-2026-66918
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Pivotick — versions 0