PT-2026-65497 · Pivotick · Pivotick

Jeroen Pinoy + 1 · CVE-2026-67174 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities.

The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-67174

Affected Products

Pivotick

References · 2

• https://github.com/Pivotick/Pivotick/commit/67c597cdf7f6910f97a4c73905a7b845e0d039f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-67174 · Security Note