CVE-2026-66922

Name of the Vulnerable Software and Affected Versions Pivotick (affected versions not specified)

Description The software uses plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers within its tree-layout and cycle-detection components. Node identifiers that match properties inherited from Object.prototype, such as constructor, toString, or proto, are not treated as ordinary identifiers. This can lead to these values being interpreted as inherited properties, resolving to unexpected types, or modifying the prototype of an internal lookup object via proto assignments. An attacker providing crafted graph data can cause nodes or edges to be omitted, produce incorrect hierarchy levels, corrupt cycle-detection results, or trigger exceptions that interrupt processing and rendering, leading to a client-side denial-of-service. Additionally, the software fails to safely handle edges where the source node is missing from the node set. Furthermore, calculating maximum tree depth by spreading level values into Math.max() can exceed the JavaScript function-argument limit with large graphs, causing a denial-of-service exception.

Recommendations Replace identifier-keyed plain objects with Map instances. Ignore invalid edges during tree construction. Calculate the maximum depth iteratively instead of using Math.max() with spread syntax.