CVE-2026-33742 Details
Description
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output.
A stored cross-site scripting vulnerability has been identified in Invoice Ninja versions prior to 5.13.4. The issue arises in the product notes field, which allows raw HTML through Markdown rendering. This unfiltered input enables the execution of malicious scripts. The vulnerability was introduced because the Markdown parser output was not properly sanitized before being incorporated into invoice templates.
Users can update to Invoice Ninja version 5.13.4 or later, where this vulnerability has been fixed by adding the necessary output sanitization.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4 | [email protected] | Release Notes |
| https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| invoiceninja invoice ninja | < 5.13.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |