CVE-2026-66921
Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
Description
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference tokenizer rejected only square brackets, a crafted node name could still contain quotation marks, angle brackets, or other HTML metacharacters. An attacker could therefore terminate the quoted attribute or inject additional HTML elements and event-handler attributes. When malicious node-reference content is rendered by a consumer that does not apply DOMPurify or equivalent sanitization, arbitrary JavaScript may execute in the victim’s browser in the security context of the application. Successful exploitation requires a victim to open or render a crafted graph or note and could allow the attacker to access same-origin information, modify displayed content, or perform actions using the victim’s session. The patch resolves the issue by applying context-appropriate HTML escaping to node names before inserting them into either HTML text or quoted attribute values. The shared escaping function now encodes ampersands, angle brackets, and both types of quotation marks.
INFO
Published Date :
July 28, 2026, 2:16 p.m.
Last Modified :
Oct. 24, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | MEDIUM | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Apply context-appropriate HTML escaping to node names.
- Encode ampersands, angle brackets, and quotation marks.
- Sanitize rendered HTML using DOMPurify or equivalent.
- Update Pivotick's Markdown node-reference renderer.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-66921.
| URL | Resource |
|---|---|
| https://github.com/Pivotick/Pivotick/commit/4c13ff2b0ec769881b5526feddef37c0c5a08885 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-66921 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-66921
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-66921 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-66921 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References, Description: El renderizador de referencia de nodos Markdown de Pivotick no logró escapar en HTML el valor nodeName controlado por el atacante antes de interpolarlo tanto en el atributo data-node-name como en el cuerpo de un elemento [span] generado. Debido a que el tokenizador de referencia de nodos rechazaba solo corchetes, un nombre de nodo manipulado aún podía contener comillas, corchetes angulares u otros metacaracteres HTML. Un atacante podría, por lo tanto, terminar el atributo entre comillas o inyectar elementos HTML adicionales y atributos de gestor de eventos. Cuando el contenido malicioso de referencia de nodos es renderizado por un consumidor que no aplica DOMPurify o una sanitización equivalente, JavaScript arbitrario puede ejecutarse en el navegador de la víctima en el contexto de seguridad de la aplicación. La explotación exitosa requiere que una víctima abra o renderice un gráfico o nota manipulado y podría permitir al atacante acceder a información del mismo origen, modificar el contenido mostrado o realizar acciones utilizando la sesión de la víctima. El parche resuelve el problema aplicando un escape HTML apropiado al contexto a los nombres de nodo antes de insertarlos en texto HTML o valores de atributo entre comillas. La función de escape compartida ahora codifica ampersands, corchetes angulares y ambos tipos de comillas. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 28, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-66921', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-28T14:18:36.415287Z'} -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Jul. 28, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/Pivotick/Pivotick', 'vendor': 'pivotick', 'product': 'pivotick', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.4.0'}], 'defaultStatus': 'unaffected'}] Added Description Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference tokenizer rejected only square brackets, a crafted node name could still contain quotation marks, angle brackets, or other HTML metacharacters. An attacker could therefore terminate the quoted attribute or inject additional HTML elements and event-handler attributes. When malicious node-reference content is rendered by a consumer that does not apply DOMPurify or equivalent sanitization, arbitrary JavaScript may execute in the victim’s browser in the security context of the application. Successful exploitation requires a victim to open or render a crafted graph or note and could allow the attacker to access same-origin information, modify displayed content, or perform actions using the victim’s session. The patch resolves the issue by applying context-appropriate HTML escaping to node names before inserting them into either HTML text or quoted attribute values. The shared escaping function now encodes ampersands, angle brackets, and both types of quotation marks. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/Pivotick/Pivotick/commit/4c13ff2b0ec769881b5526feddef37c0c5a08885