Pivotick contains a stored DOM‑based cross‑site scripting flaw in the node inspect and edit modals. Node labels and descriptions that come from graph data are inserted directly into the header’s HTML. An attacker who can add or change graph data can inject malicious markup or JavaScript that will be parsed when a user opens the modal. If the payload runs, it can read or modify data in the victim’s session, change application state, or perform further actions as the victim. This is a browser‑side execution vulnerability classified under CWE‑79.

Affected entity: Pivotick by Pivotick. The flaw exists in the node modal handling within the Pivotick application; version information is not specified in the CVE record, so any installation containing the affected code path is potentially vulnerable until the fix is applied.

CVSS score 6.9 indicates moderate severity. EPSS < 1% suggests a very low likelihood of widespread exploitation today. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector requires the ability to supply or alter graph data and a user to open the affected modal, the exploitation likelihood is limited to environments where such data can be injected, such as private or internal networks. Nonetheless, once the modal is displayed, the script runs with the application’s origin, giving the attacker full session privileges.