CVE-2026-71233 Details
Description
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.
A cross-site scripting (XSS) vulnerability has been identified in Invoice Ninja version 5-stable. The issue arises because the application renders the 'terms' field of an invoice or quote in the client portal without proper HTML sanitization. This vulnerability allows an authenticated user with permission to create invoices to inject HTML or JavaScript into the 'terms' field via the REST API. When the client views the invoice, the injected payload is executed in their browser, potentially leading to session cookie theft and unauthorized access to the client's account.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/invoiceninja/invoiceninja | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| InvoiceNinja | v5-stable |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |