This is a stored XSS vulnerability in Pivotick's node rendering. The style.svgIcon property accepts SVG markup and renders it via innerHTML, meaning any attacker-controlled data flowing into your graph structure can inject arbitrary JavaScript. If your application uses Pivotick to render graphs that include user-submitted content, external data feeds, or any graph data you don't fully control, you have an exploitable condition.
The attack surface is broader than it first appears. Visualization libraries like Pivotick sit at the intersection of data and display—they're commonly embedded in dashboards, admin panels, and reporting tools that already have access to sensitive information. Compromising the rendering layer doesn't just give you script execution in a sandbox; it gives you execution in the context of whatever authenticated session is viewing the graph. This is why the blast radius of visualization library vulnerabilities consistently exceeds their CVSS scores—the impact propagates vertically into whatever system consumes the visualization.
Immediate things to check: audit your codebase for calls to svgIcon or style.svgIcon on Pivotick nodes, particularly where the icon value derives from user input, API responses, or database content. If you're passing any untrusted data there, treat it as actively exploitable until patched. Also check your dependency tree—Pivotick may have been pulled in transitively through a charting dashboard or reporting library you don't directly control.
On the fix: when the patch arrives, verify what actually changed. The ideal fix adds DOM-based sanitization before the innerHTML render. A weaker fix simply removes the svgIcon feature entirely. Either way, treat any legacy path as potentially dangerous and monitor for deprecation warnings that may appear in future versions—deprecated rendering methods have a history of persisting in production years after they're marked unsafe.