CVE-2026-33628

MEDIUM EPSS 13.8%
Published Mar 26, 20263mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Mar 26, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
13.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-116
CWE-184
CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
invoiceninjainvoice_ninja* <5.13.4

References 3

  • github.com https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091
    Patch
  • github.com https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4
    Release Notes
  • github.com https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p
    Vendor Advisory

Remediation

  • github.com https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091
    Patch