CVE-2026-25596: 
NixOS vulnerability analysis and mitigation

CVE-2026-25596 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane, a self-hosted open source invoicing application. It affects InvoicePlane version 1.7.0 and likely prior versions, where an authenticated administrator can inject malicious JavaScript via the Product Unit Name fields that executes in other administrators' browsers when they view an invoice containing the malicious unit. The vulnerability was published on February 18, 2026, and patched in version 1.7.1. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). Specifically, the unit_name and unit_name_plrl fields are rendered without HTML encoding in invoice item dropdowns in two view files: application/modules/invoices/views/partial_itemlist_table.php (line 127) and application/modules/invoices/views/partial_itemlist_responsive.php (line 71). An authenticated administrator with access to the Units management interface can store a malicious JavaScript payload (e.g., alert(1)) in the Unit Name field; the payload executes in any administrator's browser session when they view an invoice that includes a product associated with the malicious unit. Exploitation requires administrator-level privileges to inject the payload and user interaction (another admin viewing the invoice) to trigger it (GitHub Advisory).

Successful exploitation enables an admin-to-admin attack where the injected script executes in the victim administrator's browser session. This could allow an attacker to steal CSRF tokens, perform unauthorized administrative actions on behalf of the victim, hijack session cookies, or inject phishing content into the application interface. Confidentiality and integrity are both impacted at a low level, while availability is unaffected (GitHub Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, detailing the exact steps to reproduce the vulnerability. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authenticate as Administrator: Log in to the InvoicePlane instance with administrator credentials.
2. Navigate to Units Management: Go to /index.php/units/form to access the product unit creation form.
3. Inject Malicious Payload: Enter a JavaScript payload (e.g., <script>alert(document.cookie)</script> or a more sophisticated payload to exfiltrate session tokens) into the Unit Name field and save the unit.
4. Associate Unit with a Product: Create or edit a product and assign the malicious unit to it.
5. Add Product to an Invoice: Add the product with the malicious unit to any invoice in the system.
6. Trigger XSS: When any administrator views the invoice at /index.php/invoices/view/{id}, the unencoded unit_name field renders the injected JavaScript in their browser, executing the payload and potentially stealing their session cookie or CSRF token (GitHub Advisory).

• Logs: Web server access logs showing POST requests to /index.php/units/form with unusual or encoded content in the unit name parameter; access logs showing multiple administrators viewing the same invoice in a short timeframe.
• Application Data: Product unit names in the database containing HTML tags, JavaScript keywords (<script>, alert, document.cookie, onerror, etc.), or encoded variants thereof.
• Network: Unexpected outbound HTTP requests from administrator browsers to external domains shortly after viewing invoices, potentially indicating data exfiltration via injected scripts.
• Browser/Session: Unexplained administrative actions (e.g., new user creation, settings changes) performed under a legitimate administrator's session without their knowledge.

Upgrade InvoicePlane to version 1.7.1, which patches the vulnerability by adding htmlsc() HTML encoding to the unit_name and unit_name_plrl fields in the affected view files (commit 93622f2) (GitHub Commit). As a short-term workaround prior to upgrading, restrict administrative access to only fully trusted users and audit existing product unit names for suspicious content. Additionally, implementing a strict Content Security Policy (CSP) header can reduce the impact of any XSS exploitation (GitHub Advisory).

The vulnerability was reported by security researcher lagathos and published as a GitHub Security Advisory by the InvoicePlane maintainer nielsdrost7 on February 16, 2026. A technical write-up was published by Infinit Security at infinitsec.net, and the vulnerability was catalogued by INCIBE-CERT (Spain's national cybersecurity incident response team). No significant broader media coverage or notable social media discussion has been identified (GitHub Advisory).