CVE-2026-26270: 
NixOS vulnerability analysis and mitigation

CVE-2026-26270 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane, a self-hosted open source invoicing application. It allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field, which then executes in the browsers of any user who views the invoice list or main dashboard. The vulnerability affects InvoicePlane version 1.7.0 and was published on February 18, 2026, with a patch released in version 1.7.1. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize or HTML-encode user-supplied input in the "Identifier Format" field of the Invoice Group creation form before storing it in the database and rendering it in the UI. When an invoice is subsequently generated using the affected group, the stored payload executes in the browser context of any user — including administrators — who navigates to the Invoices page or Dashboard. A proof-of-concept payload demonstrated in the advisory is {{{id}}}alert(document.cookie), which triggers upon page load without further attacker interaction after initial injection (GitHub Advisory).

Successful exploitation enables an attacker to steal session cookies of other users (including administrators), perform unauthorized actions on their behalf, deface the dashboard, or redirect users to malicious websites. Because the payload executes for all users viewing the invoice list or dashboard, the blast radius extends to every authenticated user of the application, including privileged accounts. This could facilitate privilege escalation within the application and exposure of sensitive financial data (GitHub Advisory, Feedly).

No public proof-of-concept exploit code beyond the advisory's PoC description is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with Invoice Group management permissions, limiting the attacker pool (GitHub Advisory, Feedly).

1. Gain access: Authenticate to the InvoicePlane instance using an account that has permissions to manage Invoice Groups (e.g., an administrator or a user with delegated Invoice Group management rights).
2. Navigate to Invoice Group creation: Go to the Invoice Groups management section within the application settings.
3. Inject XSS payload: In the "Identifier Format" field, enter a malicious JavaScript payload such as {{{id}}}<script>alert(document.cookie)</script> or {{{id}}}alert(document.cookie) and save the Invoice Group.
4. Associate an invoice: Create a new invoice and associate it with the newly created Invoice Group containing the XSS payload, causing the payload to be stored in the database.
5. Trigger execution: When any other user (including administrators) navigates to the Invoices list page or the main Dashboard, the stored payload is rendered without proper encoding and executes in their browser context, enabling session cookie theft or other malicious actions (GitHub Advisory).

• Logs: Web server access logs showing POST requests to the Invoice Group creation/edit endpoint (e.g., /invoice_groups/save) containing HTML or JavaScript special characters (<, >, alert, script, document.cookie) in the identifier_format parameter.
• Database: Unexpected JavaScript or HTML tags stored in the ip_invoice_groups table's identifier format column (e.g., entries containing <script>, alert(, document.cookie, or onerror=).
• Network: Outbound requests from users' browsers to attacker-controlled domains shortly after viewing the invoice list or dashboard, potentially carrying session tokens as query parameters.
• Application Behavior: Unexpected JavaScript alert dialogs or browser redirects occurring when authenticated users navigate to the Invoices page or Dashboard (GitHub Advisory).

Upgrade InvoicePlane to version 1.7.1, which patches this vulnerability by adding proper HTML encoding (htmlsc()) and input sanitization to the Identifier Format field and other affected areas. The fix is available in commit 93622f2df88a860d89bfee56012cabb2942061d6. As interim mitigations, restrict Invoice Group management permissions to trusted administrators only, and consider implementing Content Security Policy (CSP) headers to reduce the impact of any residual XSS vectors. Review existing Invoice Group configurations for suspicious payloads in the Identifier Format field (GitHub Commit, GitHub Advisory).

The vulnerability was reported by researcher "IamLeandrooooo" and published as a GitHub Security Advisory (GHSA-432m-jv69-qp5j) by the InvoicePlane maintainer on February 16, 2026. Coverage has been limited to vulnerability aggregator sites and the InvoicePlane project's own security advisory, with no notable broader media or social media discussion identified (GitHub Advisory).