CVE-2026-14791: Crater Invoice XSS Vulnerability

CVE-2026-14791 Overview

CVE-2026-14791 is a cross-site scripting (XSS) vulnerability affecting the Crater invoicing application from crater-invoice-inc in versions up to and including 6.0.6. The flaw resides in the getFormattedString function within app/Http/Requests/InvoicesRequest.php, part of the Invoice Note Handler component. An authenticated attacker can inject malicious script content through the notes argument, which is later rendered without proper sanitization. The attack is remotely exploitable and requires limited user interaction. Public exploit details have been disclosed, and the project maintainers have not yet responded to the issue report. The weakness is classified under CWE-79.

Critical Impact
Attackers can inject persistent JavaScript into invoice notes, enabling session-based attacks against users who view affected invoices.

Affected Products

Crater Invoice (crater-invoice-inc/crater) versions up to 6.0.6
Invoice Note Handler component (app/Http/Requests/InvoicesRequest.php)
Deployments exposing the invoice notes field to multi-user access

Discovery Timeline

2026-07-06 - CVE-2026-14791 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14791

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw ([CWE-79]) in the Crater invoicing platform, a Laravel-based open-source billing application. The defective code path lives in the getFormattedString function of app/Http/Requests/InvoicesRequest.php, which handles the notes field submitted with invoice requests. The function returns the note content in a form that is later rendered to end users without adequate output encoding or input sanitization. An attacker with the ability to create or update an invoice can supply JavaScript payloads inside the notes argument. When another authenticated user, such as an administrator or accounting reviewer, opens the invoice, the browser executes the attacker-controlled script in the context of the Crater application.

Root Cause

The root cause is missing output encoding on user-supplied invoice note content. The getFormattedString helper formats the notes field for display, but it does not neutralize HTML or JavaScript metacharacters. Any special characters submitted by an authenticated user are preserved verbatim and returned to the browser inside the rendered invoice view.

Attack Vector

Exploitation requires network access to the Crater application and a low-privilege authenticated account capable of creating or editing invoices. The attacker embeds a script payload in the notes field. When a victim views the invoice, the injected script executes with the victim's session privileges. Successful exploitation can lead to session token theft, forced actions on behalf of the victim, or defacement of invoice content. A public proof of concept has been disclosed on the Crater GitHub issue tracker.

Because no verified exploit code is available from an authoritative source, refer to the linked issue report for payload details rather than synthetic reconstructions.

Detection Methods for CVE-2026-14791

Indicators of Compromise

Invoice note fields containing HTML tags such as <script>, <img onerror=>, or javascript: URIs.
Unusual outbound requests from user browsers to attacker-controlled domains shortly after loading an invoice page.
Unexpected session activity or privilege changes following invoice reviews by administrative users.

Detection Strategies

Inspect the notes column in the Crater invoices database table for entries containing script tags, event handlers, or encoded JavaScript.
Monitor HTTP request bodies to /api/v1/invoices endpoints for payloads carrying HTML or JavaScript syntax within the notes parameter.
Deploy a web application firewall rule to flag XSS signatures targeting invoice creation and update endpoints.

Monitoring Recommendations

Enable application-level audit logging for all invoice create and update operations, capturing the submitting user and full request payload.
Correlate invoice edits with subsequent session anomalies such as impossible-travel logins or new administrative actions.
Alert on Content Security Policy (CSP) violation reports originating from invoice view routes.

How to Mitigate CVE-2026-14791

Immediate Actions Required

Restrict invoice creation and editing to trusted internal users until a patched release is available.
Audit existing invoice notes for embedded HTML or script content and sanitize or remove affected records.
Deploy a strict Content Security Policy that disallows inline scripts on invoice rendering pages.

Patch Information

No vendor patch is currently available. The maintainers of crater-invoice-inc/crater have not responded to the issue disclosure at the time of publication. Track the upstream GitHub repository and the associated issue for remediation updates. Additional advisory context is available at the VulDB entry for CVE-2026-14791.

Workarounds

Apply a reverse-proxy filter that strips or encodes HTML metacharacters from the notes parameter on invoice API requests.
Modify the getFormattedString function in app/Http/Requests/InvoicesRequest.php locally to escape output using Laravel's e() helper or htmlspecialchars().
Enforce a browser-side CSP header with default-src 'self' and script-src 'self' to block inline script execution on invoice views.

bash

# Example nginx configuration to add a restrictive CSP header for Crater
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;