CVE-2026-33742: Invoice Ninja Stored XSS Vulnerability

CVE-2026-33742 Overview

Invoice Ninja, a source-available invoice, quote, project, and time-tracking application built with Laravel, contains a stored Cross-Site Scripting (XSS) vulnerability in version v5.13.0. The product notes fields allow raw HTML injection through Markdown rendering, as the Markdown parser output was not sanitized with purify::clean() before being included in invoice templates. This enables attackers to inject malicious scripts that execute in the context of other users viewing the affected invoices.

Critical Impact
Authenticated attackers can inject persistent malicious JavaScript payloads through product notes fields, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of other users viewing invoices.

Affected Products

Invoice Ninja v5.13.0
Invoice Ninja versions prior to v5.13.4

Discovery Timeline

2026-03-26 - CVE CVE-2026-33742 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33742

Vulnerability Analysis

This stored XSS vulnerability exists in Invoice Ninja's handling of Markdown content within product notes fields. The application utilizes a Markdown parser to convert user-supplied Markdown text into HTML for rendering in invoice templates. However, the rendered HTML output was not properly sanitized before being included in the final invoice view.

The core issue stems from the Markdown parser allowing raw HTML to pass through during the conversion process. When users with appropriate privileges create or edit product notes containing malicious HTML or JavaScript, this content is stored in the database and subsequently rendered without sanitization to any user viewing the affected invoice.

The vulnerability requires authentication and user interaction for successful exploitation, as an attacker must have access to create or modify product notes, and a victim must view an invoice containing the malicious payload.

Root Cause

The root cause is the absence of output sanitization on Markdown-rendered content. The Invoice Ninja application failed to apply the purify::clean() function to sanitize the HTML output generated by the Markdown parser before embedding it into invoice templates. This allowed raw HTML elements, including <script> tags and event handlers, to be preserved and executed in the browser context.

Attack Vector

The attack is network-based and requires an authenticated user with permissions to modify product notes. The attacker injects malicious JavaScript or HTML into a product notes field using Markdown syntax that preserves raw HTML. When another user views an invoice containing this product, the malicious script executes in their browser session.

The exploitation flow involves:

An authenticated attacker creates or modifies a product with malicious HTML/JavaScript in the notes field
The Markdown parser processes the content, preserving the raw HTML
The unsanitized output is stored and later rendered in invoice templates
When a victim views the invoice, the malicious script executes with their session context

Detection Methods for CVE-2026-33742

Indicators of Compromise

Unexpected HTML tags or JavaScript in product notes database fields
Presence of <script>, <iframe>, <img onerror=, or event handler attributes in stored product data
Suspicious Markdown content containing encoded or obfuscated HTML payloads
Anomalous user session activity following invoice views

Detection Strategies

Implement content security policy (CSP) headers to detect and block inline script execution
Monitor database entries for product notes containing suspicious HTML patterns
Review application logs for unusual product modification activity
Deploy web application firewall (WAF) rules to detect XSS payloads in form submissions
Conduct regular security scans of stored content for potential XSS vectors

Monitoring Recommendations

Enable verbose logging for product creation and modification events
Set up alerts for product notes containing potentially malicious HTML patterns
Monitor for CSP violation reports that may indicate attempted XSS exploitation
Track session anomalies that could indicate successful XSS-based session hijacking

How to Mitigate CVE-2026-33742

Immediate Actions Required

Upgrade Invoice Ninja to version v5.13.4 or later immediately
Audit existing product notes for any malicious HTML or JavaScript content
Review user activity logs to identify potential exploitation attempts
Consider temporarily restricting product notes editing to trusted administrators

Patch Information

The vendor has addressed this vulnerability in Invoice Ninja v5.13.4 by implementing purify::clean() to sanitize all Markdown output before rendering in invoice templates. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to:

Workarounds

Implement a Content Security Policy (CSP) that restricts inline script execution
Manually sanitize existing product notes data to remove any HTML or JavaScript content
Restrict product editing permissions to trusted users only until the patch can be applied
Deploy a WAF with XSS protection rules as an additional defense layer

bash

# Content Security Policy header configuration (Apache example)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"