CVE-2026-71233: InvoiceNinja: Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the terms field via the REST API (PUT /api/v1/invoices/{id}) to an HTML/JavaScript payload that executes in the client's browser when they view the invoice, enabling session cookie theft and client account takeover. This is a distinct code path from the previously published invoice line-item description field XSS (GHSA-98wm-cxpw-847p / CVE-2026-33628).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71233?
The severity of CVE-2026-71233 is rated high with a CVSS score of 8.7.
How do I fix CVE-2026-71233?
To fix CVE-2026-71233, ensure that HTML sanitization is implemented for the terms field before rendering it in the client portal.
What type of vulnerability is CVE-2026-71233?
CVE-2026-71233 is a stored Cross-Site Scripting (XSS) vulnerability.
Which software is affected by CVE-2026-71233?
CVE-2026-71233 affects InvoiceNinja v5-stable.
What are the potential impacts of CVE-2026-71233?
The potential impacts of CVE-2026-71233 include unauthorized access to sensitive client information and possible session hijacking.