CVE-2026-33628 MEDIUM

CVE-2026-33628: Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

Vendor Invoiceninja
Product invoiceninja
Weakness CWE-79 · XSS
Published March 26, 2026
Last update March 27, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.

Key dates

02Disclosure timeline

March 26, 2026 CVE published
March 27, 2026 Record updated