Pivotick’s generic UI element resolution and icon rendering utilities treat any resolved string as raw HTML, assigning it to a <template> element via innerHTML. This allows strings derived from untrusted graph properties or custom rendering callbacks to inject arbitrary HTML or SVG elements into the live document. In addition, the createIcon function inserts caller‑supplied SVG markup into a template without sanitization, creating a second script‑execution route. An attacker who can supply a crafted graph, property value, rendering result, or SVG icon can therefore cause arbitrary JavaScript to run in the browser of any user who views or interacts with the affected content, enabling disclosure of data, manipulation of graph state, or execution of actions under the victim’s privileges.

All consumers of the Pivotick library, including the Pivotick application and any third‑party integrations that use its generic UI rendering path or icon creation functions, are potentially affected. The vulnerability exists regardless of product version, as no version information is specified in the advisory; however, the advisory notes that a fix has been committed. Applications that rely on Pivotick’s default rendering of graph properties, headers, property panels, extra panels, tooltips, or icon rendering may all be impacted.

The CVSS score of 9.2 classifies this issue as critical, but the EPSS score of less than 1% indicates that, while the vulnerability is severe, the likelihood of exploitation in the wild is currently low. Pivotick is not listed in the CISA KEV catalog, suggesting there is no documented large‑scale exploitation yet. The attack does not require authentication and can be performed through user‑initiated interactions with the UI, making it accessible to anonymous users who can supply data that is rendered by the library. Successful exploitation can lead to cross‑site scripting in the victim’s browser, allowing the attacker to steal credentials, manipulate application state, or perform privileged actions.