CVE-2026-67174

Name of the Vulnerable Software and Affected Versions Pivotick (affected versions not specified)

Description A DOM-based cross-site scripting issue exists in generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement() function treats resolved strings as HTML markup by assigning them to a <template> element via innerHTML, allowing arbitrary HTML or SVG elements to be introduced into the document through untrusted graph properties or custom rendering callbacks. This function affects headers, property panels, extra panels, and tooltips. Furthermore, the createIcon() function inserts svgIcon markup into a template without sanitization. An unauthenticated attacker providing a crafted graph, property value, rendering result, or SVG icon can execute JavaScript in a user's browser, potentially leading to unauthorized information access, manipulation of graph data or application state, and actions performed with the victim's privileges.

Recommendations Update the software to a version where string rendering uses textContent instead of innerHTML and SVG icon markup is sanitized before DOM insertion. As a temporary mitigation, restrict the use of untrusted graph properties, custom rendering callbacks, and caller-supplied SVG icons in the tryResolveHTMLElement() and createIcon() functions.