CVE-2026-33628
Stored XSS in Invoice Ninja Line Item Descriptions
Publication date: 2026-03-26
Last updated on: 2026-03-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| invoiceninja | invoice_ninja | to 5.13.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
| CWE-184 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33628 is a stored Cross-Site Scripting (XSS) vulnerability in Invoice Ninja versions prior to 5.13.4. It specifically affects the invoice line item description field, which was not properly sanitized before rendering.
Because the line item descriptions bypass the XSS denylist filter and are not passed through the purify::clean() sanitization function, attackers can inject malicious scripts that execute when the invoice is viewed in the PDF preview or client portal.
The attack requires an authenticated user with low privileges who can create or edit invoices, and involves user interaction when the invoice is viewed.
How can this vulnerability impact me? :
This vulnerability can impact confidentiality and integrity by allowing attackers to execute malicious scripts in the context of users viewing the invoice.
- Session hijacking
- Account takeover
- Data exfiltration
These impacts can affect any user who views the invoice, including clients, potentially leading to unauthorized access or data leakage.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Invoice Ninja installation is running a version prior to 5.13.4, as those versions do not sanitize the invoice line item description field properly.
To detect exploitation attempts or presence of malicious payloads, you can search for suspicious script tags or event handlers in the invoice line item descriptions stored in your database.
- Use SQL queries to look for suspicious patterns such as `<img src=x onerror=`, `<script>`, or other common XSS payloads in the invoice line item description fields.
- Example SQL command to find suspicious entries: `SELECT id, description FROM invoice_line_items WHERE description LIKE '%<img src=x onerror=%' OR description LIKE '%<script>%';`
- Monitor web server logs for unusual requests or payloads targeting invoice rendering endpoints, especially those containing suspicious HTML or JavaScript code.
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation is to upgrade Invoice Ninja to version 5.13.4 or later, where the vulnerability is fixed by sanitizing the invoice line item descriptions using the purify::clean() method.
If upgrading immediately is not possible, consider manually sanitizing or removing suspicious HTML or JavaScript content from invoice line item descriptions in your database.
Restrict permissions so that only trusted authenticated users can create or edit invoices, reducing the risk of malicious payload injection.
Educate users to avoid clicking on suspicious invoices or links until the system is patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows stored Cross-Site Scripting (XSS) attacks that can lead to session hijacking, account takeover, and data exfiltration for users viewing the invoice, including clients.
Such impacts on confidentiality and integrity could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches.
However, the provided information does not explicitly mention compliance implications or specific regulatory impacts.