CVE-2026-26281: 
NixOS vulnerability analysis and mitigation

CVE-2026-26281 is a stored cross-site scripting (XSS) vulnerability in InvoicePlane's Sumex invoice view that allows an authenticated user with client and invoice management privileges to inject and execute arbitrary JavaScript in the browser of any user viewing the affected invoice. It affects InvoicePlane version 1.7.0 and was published on February 18, 2026, with a patch released in version 1.7.1. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-controlled input before rendering in a web page (CWE-79). Specifically, the format_client() helper function in application/helpers/client_helper.php returns a custom client title directly without HTML escaping when the title is not a standard predefined value. The unescaped output is then echoed at line 360 of application/modules/invoices/views/view_sumex.php when a Sumex invoice is rendered, causing any stored JavaScript payload to execute in the viewer's browser. Exploitation requires the attacker to have authenticated access with client and invoice management privileges, and a victim must view the crafted invoice (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user — including administrators — who views the malicious invoice. This can lead to session hijacking (theft of session cookies), unauthorized actions performed on behalf of the victim, sensitive financial and client data theft, or redirection to malicious sites. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level due to the scoped nature of the attack (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, which includes detailed reproduction steps. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Enable Sumex Features: As an authenticated administrator, navigate to Settings → System Settings → Invoices and set the Sumex option to "Yes" and save.
2. Create a Sumex Invoice Group: Navigate to Settings → Invoice Groups, click "New", and create an invoice group with a name containing the word "Sumex" (required for the application to use the vulnerable template).
3. Create a Malicious Client: Navigate to Clients → Add Clients. In the "Title" dropdown, select "Custom". In the "Custom Title" field, enter a JavaScript payload such as <script>alert('XSS')</script> or a more targeted payload (e.g., cookie-stealing script). Complete the required fields and save the client.
4. Create a Sumex Invoice: Navigate to Invoices → Create Invoice, select the malicious client, and assign the Sumex invoice group created in step 2. Save the invoice.
5. Trigger XSS: When any user (including an administrator) views the invoice, the view_sumex.php template calls format_client(), which returns the unescaped custom title. The malicious JavaScript executes in the victim's browser, enabling session hijacking or other malicious actions (GitHub Advisory).

• Logs: Web server access logs showing requests to Sumex invoice view URLs (e.g., /invoices/view/[id]) from unusual IP addresses or at unusual times; application logs recording creation of clients with "Custom" titles containing HTML or JavaScript characters (<, >, script, alert, onerror, etc.).
• Database: Client records in the database where the client_title or custom title field contains HTML tags or JavaScript code (e.g., <script>, javascript:, onerror=).
• Network: Outbound requests from victim browsers to attacker-controlled domains following invoice page views, potentially carrying session cookie data in query parameters or POST bodies.
• Application Behavior: Unexpected JavaScript alerts or redirects occurring when users view Sumex invoices; reports from users of unusual browser behavior when accessing invoice pages (GitHub Advisory).

The primary remediation is to upgrade InvoicePlane to version 1.7.1, which patches this vulnerability by adding proper HTML escaping to the format_client() output and applying comprehensive XSS sanitization across the application (GitHub Commit). As a workaround prior to patching, restrict client and invoice management privileges to trusted users only, and consider implementing Content Security Policy (CSP) headers to limit the impact of any XSS execution. Administrators should also review and audit existing client records for suspicious custom title values and monitor access logs for anomalous activity (GitHub Advisory, Feedly).

The vulnerability was reported by security researcher "IamLeandrooooo" and published as a GitHub Security Advisory by InvoicePlane maintainer nielsdrost7 on February 16, 2026. The fix was incorporated into a broader security update in version 1.7.1 that addressed multiple XSS, LFI, and log injection vulnerabilities across the application. No significant broader media coverage or notable community commentary beyond the advisory has been identified (GitHub Advisory, GitHub Commit).