Cross-Site Scripting in Crater Invoice up to 6.0.6

Executive Summary

CVE-2026-14791 is a stored Cross-Site Scripting (XSS) vulnerability in the Crater invoicing system affecting the 'notes' field of invoices. Authenticated users with permissions to create or edit invoices can inject malicious JavaScript code into this field. This malicious code is stored without proper validation and is rendered unescaped in the customer portal and PDF templates, allowing the script to execute in the browsers of users viewing the invoice.

The vulnerability arises because the application uses unsafe HTML rendering methods such as Vue's `v-html` directive and Laravel's `{!! !!}` directive without sanitizing the input, making it possible for attackers to inject harmful scripts.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows attackers to execute arbitrary JavaScript in the browsers of customers who view the infected invoices. This can lead to several malicious outcomes including session theft, credential phishing, keylogging, or defacement of the user interface.

Since the attack can be performed by any user with delegated invoice permissions, not just administrators, it increases the risk of exploitation within organizations using Crater.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored Cross-Site Scripting (XSS) through unsanitized invoice notes in Crater. Detection involves checking for malicious JavaScript payloads in the 'notes' field of invoices, especially those created or edited by authenticated users with invoice permissions.

Since the issue is related to stored data rendered unescaped in the customer portal and PDF templates, detection can be done by inspecting invoice notes for suspicious scripts or HTML tags.

Suggested commands or methods include:

• Query the database for invoice notes containing suspicious script tags or HTML elements, for example using SQL: SELECT id, notes FROM invoices WHERE notes LIKE '%<script>%';
• Use web application security scanners or manual testing tools to input JavaScript payloads into the notes field and observe if they are executed when viewing invoices.
• Monitor HTTP traffic for unexpected script injections in responses related to invoice notes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting invoice creation and editing permissions to trusted users only, as any user with these permissions can exploit the vulnerability.

Avoid rendering invoice notes using unsafe HTML output directives such as Laravel's {!! !!} or Vue's v-html without sanitization.

Implement input sanitization or output encoding for the notes field to prevent injection of malicious scripts. This can be done by applying an allowlist approach to sanitize HTML before storage or rendering.

Since no patch is currently available, consider temporarily disabling or limiting access to the invoice notes feature if feasible.

Educate users to be cautious when viewing invoices and avoid clicking on suspicious links or scripts.

Useful 0 Not Useful 0