Medium severity5.4NVD Advisory· Published Mar 26, 2026· Updated Jun 17, 2026
CVE-2026-33742
CVE-2026-33742
Description
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with purify::clean() before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding purify::clean() to sanitize Markdown output.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*range: <5.13.4
- (no CPE)range: <5.13.4
- (no CPE)range: < 5.13.4
Patches
Vulnerability mechanics
References
2- github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mhnvdExploitVendor Advisory
- github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4nvdRelease Notes
News mentions
0No linked articles in our index yet.