Executive Summary

CVE-2026-33628 is a stored Cross-Site Scripting (XSS) vulnerability in Invoice Ninja versions prior to 5.13.4. It specifically affects the invoice line item description field, which was not properly sanitized before rendering.

Because the line item descriptions bypass the XSS denylist filter and are not passed through the purify::clean() sanitization function, attackers can inject malicious scripts that execute when the invoice is viewed in the PDF preview or client portal.

The attack requires an authenticated user with low privileges who can create or edit invoices, and involves user interaction when the invoice is viewed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact confidentiality and integrity by allowing attackers to execute malicious scripts in the context of users viewing the invoice.

• Session hijacking
• Account takeover
• Data exfiltration

These impacts can affect any user who views the invoice, including clients, potentially leading to unauthorized access or data leakage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Invoice Ninja installation is running a version prior to 5.13.4, as those versions do not sanitize the invoice line item description field properly.

To detect exploitation attempts or presence of malicious payloads, you can search for suspicious script tags or event handlers in the invoice line item descriptions stored in your database.

• Use SQL queries to look for suspicious patterns such as `<img src=x onerror=`, `<script>`, or other common XSS payloads in the invoice line item description fields.
• Example SQL command to find suspicious entries: `SELECT id, description FROM invoice_line_items WHERE description LIKE '%<img src=x onerror=%' OR description LIKE '%<script>%';`
• Monitor web server logs for unusual requests or payloads targeting invoice rendering endpoints, especially those containing suspicious HTML or JavaScript code.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade Invoice Ninja to version 5.13.4 or later, where the vulnerability is fixed by sanitizing the invoice line item descriptions using the purify::clean() method.

If upgrading immediately is not possible, consider manually sanitizing or removing suspicious HTML or JavaScript content from invoice line item descriptions in your database.

Restrict permissions so that only trusted authenticated users can create or edit invoices, reducing the risk of malicious payload injection.

Educate users to avoid clicking on suspicious invoices or links until the system is patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows stored Cross-Site Scripting (XSS) attacks that can lead to session hijacking, account takeover, and data exfiltration for users viewing the invoice, including clients.

Such impacts on confidentiality and integrity could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches.

However, the provided information does not explicitly mention compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0