CVE-2026-33742: Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with purify::clean() before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding purify::clean() to sanitize Markdown output.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33742?
The severity of CVE-2026-33742 is classified as high due to the potential for stored XSS attacks.
How do I fix CVE-2026-33742?
To fix CVE-2026-33742, upgrade Invoice Ninja to version 5.13.4 or later.
What software is affected by CVE-2026-33742?
CVE-2026-33742 affects Invoice Ninja versions prior to 5.13.4.
What type of vulnerability is CVE-2026-33742?
CVE-2026-33742 is a stored cross-site scripting (XSS) vulnerability.
What is the impact of CVE-2026-33742 on users?
The impact of CVE-2026-33742 allows attackers to inject malicious scripts that can execute in the context of users' browsers.