Pivotick’s Markdown node‑reference renderer failed to HTML‑escape the attacker‑controlled nodeName before inserting it into both the data-node-name attribute and the element’s inner text. Because the tokenizer rejects only square brackets, an attacker can embed quotation marks, angle brackets, or other HTML metacharacters in the nodeName. When rendered without DOMPurify or similar sanitization, this allows the attacker to terminate attributes, inject additional elements, add event‑handler attributes, and execute arbitrary JavaScript in the victim’s browser. The vulnerability is a DOM‑based XSS that can lead to same‑origin information disclosure, UI fraud, or actions performed using the victim’s session.

The affected product is Pivotick, as identified by the vendor name pivotick. No specific version information is supplied, so any deployment using the Markdown node‑reference renderer that has not applied the vendor’s fix is potentially vulnerable.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that it is currently considered low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to craft a malicious note or graph that a victim will open or render; the attack vector is therefore user‑initiated interaction with malicious content, and the attacker must successfully deliver the crafted data to the victim’s browser.