Pivotick’s tree layout and cycle detection use plain JavaScript objects to map node identifiers supplied by callers. Node names that match properties inherited from Object.prototype, such as constructor, toString, or __proto__, are treated specially. An attacker can craft node identifiers that collide with these properties, causing the lookup to return unexpected values, modify the internal prototype chain, or trigger an exception. The result is that nodes or edges may be omitted, hierarchy levels become incorrect, cycle detection is bypassed or corrupted, and graph rendering can be interrupted. Moreover, edges referencing non‑existent source nodes and a depth calculation that expands all level values into Math.max() can cause the JavaScript engine to throw an exception. These behaviors undermine the integrity of visualizations and enable a client‑side denial‑of‑service condition.

Pivotick’s open‑source JavaScript library in which the flaw exists. The issue is present in any build that has not applied the fix; no specific version range is supplied in the advisory, so all unpatched releases are potentially affected.

The vulnerability has a CVSS base score of 5.1, indicating moderate severity, and an EPSS score of less than 1%, pointing to a very low predicted exploitation probability. It is not listed in CISA’s KEV catalog. The likely attack vector is a client‑side scenario in which an attacker delivers crafted graph data—such as via a malformed JSON file, a URL parameter, or an injection point in a single‑page application—to a user’s browser. Exploitation would require the victim to load the affected library; thus, the threat is confined to end‑users running the vulnerable code. Because the flaw operates entirely in the browser environment, network‑level attacks are unlikely.