CVE-2026-66921

creationtimestamp| type| source ---|---|--- 2026-07-28 15:32:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpq7ydjsq27...

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...