Pivotick employs recursive graph traversal and JSON rendering when calculating layouts or displaying nodes. A graph supplied by the user that contains an excessively long chain of edges, deeply nested properties, or circular references can exhaust the JavaScript call stack. This causes the application to throw an uncaught exception, freeze the page, or crash the browser tab. The vulnerability results in a client‑side denial of service; no confidentiality or integrity impact has been documented.

The vendor is Pivotick; the affected product is Pivotick. No specific version information is listed, but the issue is present in releases that lack the patch described in the referenced commit. The patch introduces iterative traversals and limits the traversal to 1,000,000 edges, caps JSON rendering to 64 levels, and detects circular references.

The CVSS score is 8.2, reflecting a high severity denial of service. The EPSS score is less than 1 %, indicating a very low but non‑zero likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is client‑side: an attacker must supply the malicious graph data through the Pivotick UI or file input. Successful exploitation is limited to disrupting the user’s web session and does not compromise data confidentiality or integrity.