CVE-2026-23997: FacturaScripts Stored XSS Vulnerability

CVE-2026-23997 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in FacturaScripts, an open-source enterprise resource planning (ERP) and accounting software. The vulnerability exists in version 2025.71 and earlier, specifically within the Observations field. When historical data is rendered in the History view, improper HTML entity encoding allows attackers to inject and execute arbitrary JavaScript code in the browsers of administrators viewing the affected history records.

Critical Impact

This stored XSS vulnerability enables attackers with low-privilege access to inject persistent malicious scripts that execute in administrator sessions, potentially leading to session hijacking, data theft, and unauthorized administrative actions within the ERP system.

Affected Products

• FacturaScripts version 2025.71 and earlier
• FacturaScripts History view component
• FacturaScripts Observations field functionality

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-23997 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23997

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from insufficient input sanitization and output encoding in FacturaScripts' History view functionality. When users enter data into the Observations field, the application fails to properly encode HTML entities before rendering the historical records. This architectural weakness allows malicious JavaScript payloads to persist in the database and execute whenever an administrator accesses the History view.

The attack requires a low-privileged authenticated user to inject the malicious payload, which then triggers during legitimate administrative operations. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common web application security flaw.

Root Cause

The root cause of this vulnerability is the absence of proper HTML entity encoding when rendering user-supplied content from the Observations field in the History view. The application directly outputs stored data to the browser without sanitizing potentially dangerous characters such as <, >, ", and ', which are essential for constructing HTML and JavaScript injection payloads.

Attack Vector

The attack is network-based and requires authenticated access with low privileges. An attacker must:

1. Authenticate to the FacturaScripts application with minimal user privileges
2. Locate a record with an editable Observations field
3. Insert a malicious JavaScript payload into the Observations field
4. Wait for an administrator to view the History records containing the payload
5. The malicious script executes in the context of the administrator's browser session

Once executed, the attacker's JavaScript can perform actions such as stealing session tokens, modifying sensitive accounting data, creating backdoor administrator accounts, or exfiltrating confidential financial information.

The vulnerability mechanism involves unsanitized user input being stored in the database and subsequently rendered without encoding. When the History view loads, the browser interprets the stored payload as legitimate JavaScript and executes it within the administrator's authenticated session context.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23997

Indicators of Compromise

• Unusual JavaScript code patterns in Observations field entries (e.g., <script> tags, event handlers like onerror, onload)
• Database records containing encoded or obfuscated script content in text fields
• Unexpected outbound network connections originating from administrator browser sessions
• Administrator account anomalies such as unauthorized configuration changes or new user creation

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in HTTP POST requests targeting the Observations field
• Enable database query logging and monitor for suspicious content being inserted into text fields
• Deploy Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Use browser-based security extensions or endpoint detection to identify XSS exploitation attempts

Monitoring Recommendations

• Monitor audit logs for changes made to sensitive configurations by administrator accounts
• Set up alerts for unusual patterns in the History view access logs, particularly high-frequency access from single IP addresses
• Track session anomalies where administrator sessions exhibit unexpected behavior following History view access
• Review database content periodically for HTML/JavaScript artifacts in text-based fields

How to Mitigate CVE-2026-23997

Immediate Actions Required

• Upgrade FacturaScripts to a version newer than 2025.71 that includes the security fix
• Audit existing Observations field data for potentially malicious content and sanitize as needed
• Implement Content Security Policy (CSP) headers to restrict inline script execution
• Consider temporarily restricting access to the History view functionality for non-essential users

Patch Information

The vendor has addressed this vulnerability through a security update. Organizations running FacturaScripts version 2025.71 or earlier should upgrade immediately. For detailed patch information and remediation guidance, consult the GitHub Security Advisory.

Workarounds

• Implement server-side input validation to strip or encode HTML entities from the Observations field before storage
• Deploy a reverse proxy or WAF with XSS filtering capabilities in front of the application
• Restrict write access to the Observations field to only trusted administrator accounts until patching is complete
• Enable browser-based XSS protection mechanisms via response headers (X-XSS-Protection)

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"