Invoice Ninja v5.13.0 introduced a flaw where line item descriptions were not passed through the purify::clean() function before rendering, allowing malicious JavaScript to be injected into invoices. When a victim views the invoice PDF preview or accesses the client portal, the embedded script executes in their browser, potentially stealing session cookies or performing other unauthorized actions. This is a classic stored XSS defect, identified by CWE‑79 and related to improper input validation (CWE‑116, CWE‑184).

The vulnerability affects the Invoice Ninja application, specifically versions 5.13.0 through 5.13.3. It is tied to the invoice line item description field and is fixed in version 5.13.4, where purify::clean() sanitisation is applied. Users of any earlier release of the open‑source Invoice Ninja project are therefore impacted.

The CVSS base score rates the flaw as medium (5.4). EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires an attacker to submit or modify an invoice line item, which is typically performed by authenticated staff or administrators. Once the malicious payload is stored, any user who opens the invoice in the PDF preview or client portal will be exposed to the injected JavaScript. The risk is therefore moderate, with the main threat being the potential compromise of client accounts or unintended script execution in the application.