This vulnerability is located in the getFormattedString method of the Invoice Note Handler within crater. By manipulating the notes argument, an attacker can inject arbitrary JavaScript that is later rendered when the note is viewed, creating a client‑side script execution flaw. The weakness classifies as a cross‑site scripting issue (CWE‑79) combined with a potential code‑injection context (CWE‑94), enabling attacks such as cookie theft, session hijacking, and malicious content injection.

Crater (crater‑invoice‑inc:crater) released up to and including version 6.0.6 is affected. The issue remains present in the latest public release available at the time of analysis and has not yet been patched by the maintainers.

The CVSS score of 5.1 places this flaw in the moderate severity range, while the EPSS score of less than 1 % indicates a low likelihood of exploitation and it is not listed in the CISA KEV catalog. Remote attackers can trigger the vulnerability by submitting a crafted notes field, and the malicious payload is executed in any victim’s browser upon viewing the note. The impact is limited to compromised client machines unless the attacker can achieve further privilege escalation.