CVE-2026-33628: 
PHP vulnerability analysis and mitigation

CVE-2026-33628 is a stored Cross-Site Scripting (XSS) vulnerability in Invoice Ninja, a source-available invoicing and time-tracking application built with Laravel. Invoice line item description fields in Invoice Ninja v5.13.0 bypass the application's XSS denylist filter, allowing authenticated users to inject malicious scripts that execute when invoices are rendered in the PDF preview or client portal. All versions prior to 5.13.4 are affected. The vulnerability was discovered by researcher morimori-dev, published on March 22, 2026, and patched in v5.13.4. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Vendor Advisory).

The root cause is an incomplete denylist-based input sanitization mechanism (CWE-184) combined with improper output encoding (CWE-116) and improper neutralization of user input in web page generation (CWE-79). Specifically, the line item description field in invoice creation and editing was not passed through the application's Purify::clean() HTML sanitization function before being stored and rendered, meaning crafted XSS payloads could bypass the existing pattern-based denylist. The fix in commit b81a3fc refactored sanitization by applying Purify::clean($input[$field], true) to line item fields (notes, product_key, custom_value1–custom_value4) in both StoreProductRequest and UpdateProductRequest, and also extended sanitization to public notes, terms, and footer fields (Github Advisory, Patch Commit).

Successful exploitation allows any authenticated user who can create or edit invoices to inject persistent malicious scripts that execute in the browsers of any user who views the affected invoice — including clients accessing the invoice via the client portal. Concrete impacts include session hijacking, account takeover, and data exfiltration from both internal staff and external clients. The changed scope (S:C) in the CVSS vector reflects that the injected script can affect users beyond the attacker's own session, potentially compromising client accounts and sensitive financial data (Vendor Advisory, Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-33628. The vulnerability requires low privileges (any authenticated user who can create invoices) and user interaction (a victim must view the invoice). The EPSS score is approximately 0.037% (0.000370), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Authenticate: Log in to an Invoice Ninja instance (v5.13.0 up to < 5.13.4) as any user with invoice creation or editing privileges.
2. Create or edit an invoice: Navigate to the invoice creation or editing interface.
3. Inject XSS payload: In a line item description field, enter a crafted XSS payload that bypasses the denylist filter (e.g., using encoding or alternative HTML constructs such as <img src=x onerror=alert(document.cookie)> or similar variants that evade pattern-based blocking).
4. Save the invoice: Submit the invoice, causing the malicious payload to be stored in the database without sanitization.
5. Trigger execution: When any user (internal staff or external client via the client portal) views the invoice in the PDF preview or client portal, the stored XSS payload executes in their browser.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data to an attacker-controlled server (Github Advisory, Vendor Advisory).

• Logs: Web server or application logs showing invoice save requests containing HTML tags or encoded characters (e.g., <, >, &#, %3C, %3E) in line item description fields.
• Database: Invoice line item notes or description fields in the database containing unexpected HTML or JavaScript tags (e.g., <script>, <img>, onerror=, javascript:).
• Network: Outbound requests from client browsers to unexpected external domains shortly after viewing an invoice, potentially indicating data exfiltration via XSS payload.
• Browser/Client: Unexpected JavaScript alerts, redirects, or network requests originating from the Invoice Ninja client portal or PDF preview pages.

The vendor has released Invoice Ninja v5.13.4, which fixes this vulnerability by applying Purify::clean() sanitization to line item description fields and other invoice text fields. Administrators should upgrade to v5.13.4 or later immediately. No official configuration-based workaround is available; upgrading is the only recommended remediation. Organizations unable to upgrade immediately should restrict invoice creation privileges to trusted users only and monitor invoice content for suspicious HTML or script tags (v5.13.4 Release, Patch Commit).

The vulnerability was reported by researcher morimori-dev and published by the Invoice Ninja maintainer (turbo124) via GitHub Security Advisories on March 22, 2026. A technical write-up was published at infinitsec.net shortly after disclosure. Community reaction has been limited given the moderate severity rating and low EPSS score, with no significant broader media coverage identified (Github Advisory).