TI-2026-26010 Aliases CVE-2026-33628 GHSA-98wm-cxpw-847p

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

MEDIUM 58CWE-116Published 2026-03-26 · Updated 2026-03-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0024 15th percentileScored 2026-11-07

Fix Fixed invoiceninja (invoiceninja): 5.13.4invoiceninja/invoiceninja (Packagist): 5.13.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
invoiceninja	invoiceninja	before 5.13.4	5.13.4	Patch available	CNA
—	invoiceninja/invoiceninja (Packagist)	before 5.13.4	5.13.4	Patch available	GHSA-98wm-cxpw-847p

invoiceninja Vendorinvoiceninja Affected before 5.13.4 Fixed in 5.13.4 Patch available CNA
invoiceninja/invoiceninja (Packagist) Vendor— Affected before 5.13.4 Fixed in 5.13.4 Patch available GHSA-98wm-cxpw-847p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:invoiceninja:invoice_ninja::::::::	before 5.13.4	Vulnerable	invoiceninja

cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:* Versions before 5.13.4 Vulnerable ·invoiceninja

Remediation

Fix · CNA invoiceninja (invoiceninja) Fixed in 5.13.4
Fix · GHSA-98wm-cxpw-847p invoiceninja/invoiceninja (Packagist) Fixed in 5.13.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33628
2026-10-03 Alias added: GHSA-98wm-cxpw-847p

References

Patch 1

https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091

Advisory 2

Other 2

TI-2026-23400 Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. CVSS 3.1HIGH 7.7
TI-2026-26121 Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes CVSS 3.1MEDIUM 5.4
TI-2021-13213 In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in… CVSS 3.1HIGH 8.1
TI-2017-14676 Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability… CVSS 3.0MEDIUM 5.4
TI-2021-02874 Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences