CVE-2026-33628

{"id": "CVE-2026-33628", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-03-26T21:17:07.113", "references": [{"url": "https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-184"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions."}, {"lang": "es", "value": "Invoice Ninja es una aplicaci\u00f3n de facturaci\u00f3n, presupuestos, proyectos y seguimiento del tiempo de c\u00f3digo fuente disponible, construida con Laravel. Las descripciones de las l\u00edneas de art\u00edculos de las facturas en Invoice Ninja v5.13.0 eluden el filtro de denylist de XSS, permitiendo que las cargas \u00fatiles de XSS almacenadas se ejecuten cuando las facturas se renderizan en la vista previa de PDF o en el portal del cliente. El campo de descripci\u00f3n de la l\u00ednea de art\u00edculo no se pas\u00f3 por 'purify::clean()' antes de la renderizaci\u00f3n. Esto se corrigi\u00f3 en la v5.13.4 por el proveedor al a\u00f1adir 'purify::clean()' para sanear las descripciones de las l\u00edneas de art\u00edculos."}], "lastModified": "2026-03-30T17:24:09.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC4B6AFE-F1E5-491A-8E54-A20207B38036", "versionEndExcluding": "5.13.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}