Sami Mokaddem

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** A DOM-based cross-site scripting issue exists in generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement()` function treats resolved strings as HTML markup by assigning them to a `<template>` element via `innerHTML`, allowing arbitrary HTML or SVG elements to be introduced into the document through untrusted graph properties or custom rendering callbacks. This function affects headers, property panels, extra panels, and tooltips. Furthermore, the `createIcon()` function inserts `svgIcon` markup into a template without sanitization. An unauthenticated attacker providing a crafted graph, property value, rendering result, or SVG icon can execute JavaScript in a user's browser, potentially leading to unauthorized information access, manipulation of graph data or application state, and actions performed with the victim's privileges. **Recommendations** Update the software to a version where string rendering uses `textContent` instead of `innerHTML` and SVG icon markup is sanitized before DOM insertion. As a temporary mitigation, restrict the use of untrusted graph properties, custom rendering callbacks, and caller-supplied SVG icons in the `tryResolveHTMLElement()` and `createIcon()` functions.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** The Markdown node-reference renderer fails to HTML-escape the `nodeName` value before inserting it into the `data-node-name` attribute and the body of a generated `<span>` element. Since the tokenizer only rejects square brackets, an attacker can use quotation marks or angle brackets to terminate attributes or inject HTML elements and event-handler attributes. This can lead to arbitrary JavaScript execution in the victim's browser if the content is rendered without sanitization, potentially allowing the attacker to access same-origin information, modify content, or perform actions using the victim's session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** The software uses plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers within its tree-layout and cycle-detection components. Node identifiers that match properties inherited from `Object.prototype`, such as `constructor`, `toString`, or ` proto `, are not treated as ordinary identifiers. This can lead to these values being interpreted as inherited properties, resolving to unexpected types, or modifying the prototype of an internal lookup object via ` proto ` assignments. An attacker providing crafted graph data can cause nodes or edges to be omitted, produce incorrect hierarchy levels, corrupt cycle-detection results, or trigger exceptions that interrupt processing and rendering, leading to a client-side denial-of-service. Additionally, the software fails to safely handle edges where the source node is missing from the node set. Furthermore, calculating maximum tree depth by spreading level values into `Math.max()` can exceed the JavaScript function-argument limit with large graphs, causing a denial-of-service exception. **Recommendations** Replace identifier-keyed plain objects with `Map` instances. Ignore invalid edges during tree construction. Calculate the maximum depth iteratively instead of using `Math.max()` with spread syntax.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** Insufficient validation of the URL scheme for node `imagePath` values derived from graph data allows an attacker to supply crafted graph data with a malicious URI. When a victim renders the affected graph, the browser may resolve the URI, initiating unintended requests or invoking scheme-specific handling. This could lead to the disclosure of limited client or network metadata, rendering-based tracking, or attempts to access local and internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** The software fails to sanitize SVG markup provided through the `style.svgIcon` property before inserting it into the document. During graph node rendering, the system assigns this markup directly to the `innerHTML` property of a live SVG element. An attacker who can influence graph data may provide crafted markup containing executable event handlers, such as an `<image>` element with an `onerror` attribute. This can lead to the execution of arbitrary JavaScript within the security context of the application embedding Pivotick, potentially allowing the attacker to access application data, modify content, or perform actions using the victim's authenticated session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** A cross-site scripting issue exists in the inspect and edit node modals. Node labels and descriptions from graph data were interpolated directly into the HTML used for modal headers. An attacker capable of supplying or modifying graph data could insert malicious HTML or JavaScript payloads into a node label or description. These payloads are executed in the application origin when a user opens the affected node modals, potentially allowing the attacker to access victim information, modify data, or perform actions using the victim's active session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** An uncontrolled-recursion issue occurs when processing caller-supplied graph and node data. The problem exists because graph algorithms recursively traverse edges and the JSON viewer recursively processes node data structures. A specially crafted graph with circular object references, deeply nested properties, or an excessively long path can exhaust the JavaScript call stack during layout calculations or when displaying a node in the inspection modal. This can lead to a client-side denial of service, manifesting as an uncaught exception, a frozen page, or a browser tab crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pivotick (affected versions not specified) **Description** A cross-site scripting issue exists in the sidebar property-list component. The application renders values associated with link-like properties—such as `url`, `uri`, `href`, `link`, `website`, or `homepage`—as hyperlinks without validating the URL scheme. An attacker who can influence node or edge property data may provide a malicious value using the `javascript:` scheme, potentially obfuscated with control characters or whitespace. If a user clicks the resulting link, attacker-controlled JavaScript executes within the application context, allowing the attacker to perform actions with the victim's privileges or access session information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** The `importModule()` path uses the `getEnabledModule()` function to resolve a single import module by name. However, this lookup fails to enforce the per-organisation module restrictions that are normally checked by `getEnabledModules()`. Consequently, an authenticated user belonging to an organisation restricted from using a specific module via `Plugin.Import <module> restrict` can still invoke that module directly if the module name is known. This may lead to unauthorised access to restricted import-module functionality and potentially allow the unauthorised import or modification of event data, depending on the specific module and the user's event permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization bypass exists in the `importModule()` function within the `EventsController`. This flaw allows authenticated users or read-only API keys with event view access to persist data to events they are not permitted to modify. The issue occurs when an import module returns results in the misp standard format, as the write path fails to verify event modification rights before saving the output. This allows a view-only user to inject or alter event data, compromising the integrity of the event content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.