External risk intelligence

Pivotick UI XSS Vulnerability Allows Script Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-67174

This is a DOM-based cross-site scripting vulnerability in a UI component library. While the library may be used in internet-facing web applications, the vulnerability exists within the client-side code of the application itself. Public reachability depends entirely on whether the integrating application exposes the affected UI components to untrusted inputs from the internet.

Cross-site Scripting

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in the Pivotick UI component library that could allow an attacker to run malicious code in a user's browser. This vulnerability, a type of cross-site scripting, affects how the library handles certain UI elements and icon rendering, potentially exposing sensitive information or allowing unauthorized actions if exploited.

Flaw allows arbitrary code execution in browser.
Potential for sensitive data exposure or manipulation.
Confirm if affected products are used and exposed.

Attack Path

How an attacker could exploit the issue

An attacker who can influence data displayed in Pivotick's user interface, such as graph properties or custom icons, can inject malicious HTML or SVG code. This code is then processed by the application, leading to the execution of arbitrary JavaScript in the victim's browser when the affected content is viewed or interacted with. This attack does not require any prior authentication or special access.

No authentication required.
User views vulnerable UI content.
JavaScript execution in victim's browser.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a DOM-based cross-site scripting vulnerability in Pivotick's UI utilities could allow an unauthenticated attacker to execute JavaScript in another user's browser. This could occur when an affected component, such as headers, property panels, or tooltips, displays or interacts with crafted content. Successful exploitation might enable an attacker to access information visible to the victim, alter graph data or application state, and perform actions using the victim's privileges.

User session and application data.
Malicious script injected into UI elements.
Perform actions as the victim user.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application teams integrating Pivotick are likely responsible for addressing this DOM-based cross-site scripting vulnerability. The initial practical step is to identify all instances of Pivotick within your environment, confirm if the affected UI elements are exposed to untrusted input, and then engage the accountable owner to plan remediation based on the assessed risk.

Application owners should drive remediation.
Verify untrusted input exposure first.
Plan maintenance for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Pivotick?

Pivotick is a UI component library designed to help developers build interactive data visualizations and graph-based applications. It provides pre-built interface elements like headers, property panels, and tooltips that manage complex data rendering. Because it handles the visual representation of graph properties and custom icons, it is frequently embedded within web-based tools where users view or manipulate structured data and node-link diagrams.

What does this XSS vulnerability mean?

This is a DOM-based cross-site scripting (XSS) vulnerability, classified as CWE-79. It occurs because Pivotick's rendering functions incorrectly treat incoming text strings as live HTML or SVG code. When the library processes these strings, it can inadvertently execute malicious JavaScript embedded by an attacker. This allows the attacker to run code directly within the browser session of anyone viewing the compromised data, potentially accessing their private application state.

How can an attacker trigger this bug?

An attacker triggers this by providing a crafted string—such as a malicious graph property, rendering callback, or SVG icon—that the application then displays. If the application handles this data through Pivotick’s vulnerable UI utilities, the script executes when the content is rendered. This does not trigger if the application only processes trusted, static data or if it uses strict input filtering before passing content to Pivotick's components.

Is my application at risk according to Halo Surface Signal?

According to Halo Surface Signal, the risk depends on your application's architecture. Because this is a client-side UI issue, the vulnerability is only reachable if your application exposes Pivotick components to untrusted inputs from the internet. If your interface is restricted to internal users or only processes data from secure, trusted sources, the practical ability for an external attacker to inject the malicious content required for this exploit is significantly reduced.

How should I respond to CVE-2026-67174?

Your first step is to audit your software inventory to locate where Pivotick is integrated. Once identified, verify if any components handle user-provided or external data in fields like tooltips or graph properties. Coordinate with your development team to ensure the library is updated to the patched version, which enforces safe text rendering and sanitizes SVG icons. Prioritize systems that face the public internet or process data from untrusted sources.

References

github.com/Pivotick/Pivotick/commit/67c597cdf7f6910f97a4c73905a7…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.