XSS in Pivotick
CVE-2026-66921
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Pivotick — versions 0