Pivotick injects raw SVG markup into a live SVG element by assigning it directly to innerHTML. Because the per-node style.svgIcon property is not sanitized, an attacker that can influence graph data may insert malicious elements such as <image onerror="…">. When a victim renders the graph, the embedded script executes in the same security context as the hosting application, enabling the attacker to read victim data, modify displayed content, or perform actions using the authenticated session.

The flaw resides in the Pivotick library (vendor: Pivotick). Any installation of Pivotick that renders graph data that can be controlled by an attacker is potentially vulnerable; no specific version numbers are provided.

The CVSS score of 8.2 indicates a high severity flaw, while an EPSS score of less than 1% shows a low current probability of exploitation. Pivotick is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply or modify graph data that the browser receives, causing the application to render the malicious SVG icon via innerHTML, which constitutes a client‑side attack vector.