Medium severity · published Mar 26, 2026
CVE-2026-33628
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
invoiceninja · invoiceninja
< 5.13.4 · source: vendor
IN
Invoice Ninja · Invoiceninja
before 5.13.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33628
Patch
https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091
Release Notes
https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4
Vendor Advisory
https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p
More from invoiceninja
8.7
CVE-2026-71233
InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
5.4
CVE-2026-33742
Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes
4.3
CVE-2026-58450
Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter