CVE-2026-71233: InvoiceNinja XSS Vulnerability

CVE-2026-71233 Overview

CVE-2026-71233 is a stored Cross-Site Scripting (XSS) vulnerability in Invoice Ninja v5-stable. The client portal renders an invoice or quote's terms field using Laravel Blade's raw output directive {!! $entity->terms !!} in resources/views/portal/ninja2020/invoices/includes/terms.blade.php. The template performs no HTML sanitization, and StoreInvoiceRequest.php only strips newlines from the field. An authenticated user with invoice creation access can inject an HTML or JavaScript payload through the REST API endpoint PUT /api/v1/invoices/{id}. The payload executes in the client's browser when they view the invoice, enabling session cookie theft and client account takeover.

Critical Impact
An authenticated attacker with invoice creation privileges can hijack client portal sessions and take over customer accounts through injected JavaScript in the terms field.

Affected Products

Invoice Ninja v5-stable
Client portal template resources/views/portal/ninja2020/invoices/includes/terms.blade.php
API endpoint PUT /api/v1/invoices/{id} and equivalent quote endpoints

Discovery Timeline

2026-08-05 - CVE-2026-71233 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71233

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified as [CWE-79]. Invoice Ninja's client portal renders invoice and quote terms content using Laravel Blade's unescaped {!! ... !!} syntax. This directive bypasses Blade's default HTML entity encoding and emits raw markup directly into the rendered page. Any HTML or <script> payload persisted in the terms column executes with the client's origin when the portal page loads.

Input validation in StoreInvoiceRequest.php only strips newline characters from the field. It performs no HTML purification, tag allow-listing, or JavaScript filtering. This code path is distinct from the previously disclosed invoice line-item description XSS tracked as GHSA-98wm-cxpw-847p / CVE-2026-33628, so prior patches for that issue do not remediate this one.

Root Cause

The root cause is the use of Blade's raw output directive on user-controlled content combined with insufficient input sanitization. The template trusts stored data as safe HTML, and the request validator does not enforce an HTML purifier such as HTMLPurifier or Laravel's e() escaping. The result is direct persistence and rendering of attacker-controlled markup.

Attack Vector

An authenticated user with invoice creation access issues a PUT /api/v1/invoices/{id} request setting the terms field to an XSS payload. When the target client opens the invoice in the client portal, the payload executes in the browser session. An attacker can exfiltrate session cookies, perform actions as the client, or pivot to full account takeover. The attack requires user interaction from the victim (viewing the invoice) and privileges to create or modify invoices.

See the Invoice Ninja GitHub repository for the affected template and request handler source.

Detection Methods for CVE-2026-71233

Indicators of Compromise

Invoice or quote records containing <script>, onerror=, onload=, javascript:, or event handler attributes inside the terms column.
Outbound requests from client portal browser sessions to unfamiliar domains shortly after loading an invoice.
Unexpected session activity or authentication events for client portal accounts following invoice views.

Detection Strategies

Query the invoices and quotes database tables for terms values matching regex patterns for HTML tags or JavaScript URIs.
Inspect web server logs for PUT /api/v1/invoices/ and PUT /api/v1/quotes/ requests with request bodies containing script-like content.
Enable browser Content Security Policy (CSP) reporting to surface inline script execution on portal pages.

Monitoring Recommendations

Alert on API modifications to invoice terms fields by non-administrative accounts.
Monitor client portal responses for reflected script content using DOM inspection or a web application firewall.
Review audit logs for anomalous invoice creation or modification volume from a single authenticated account.

How to Mitigate CVE-2026-71233

Immediate Actions Required

Upgrade Invoice Ninja to a patched release once the maintainers publish a fix; monitor the Invoice Ninja GitHub repository for release notes.
Audit existing invoice and quote terms fields for stored HTML or JavaScript payloads and sanitize or remove offending records.
Restrict invoice creation privileges to trusted internal accounts and revoke access for unnecessary users.

Patch Information

No patch details are listed in the NVD entry at the time of publication. Track the Invoice Ninja GitHub repository for commits modifying terms.blade.php and StoreInvoiceRequest.php that introduce HTML sanitization.

Workarounds

Replace {!! $entity->terms !!} with the escaped {{ $entity->terms }} directive in resources/views/portal/ninja2020/invoices/includes/terms.blade.php if raw HTML rendering is not required.
Add HTMLPurifier or a similar sanitizer to StoreInvoiceRequest.php to strip scripts and event handler attributes before persistence.
Deploy a strict Content Security Policy on the client portal that disallows inline scripts and untrusted origins.

bash

# Example CSP header for the client portal (Nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;