A denial‑list bypass in Invoice Ninja’s line item description field allows attackers to insert JavaScript payloads that are stored and later rendered without sanitization. When an invoice is viewed in the PDF preview or client portal, the malicious code executes in the victim’s browser, potentially exposing session cookies, accessing user data, or performing actions on behalf of the user. The issue is based on the weaknesses of CWE‑79, CWE‑116 and CWE‑184.

The vulnerability affects the Invoice Ninja application, specifically versions from 5.13.0 up through 5.13.3. The designated vendor product is Invoice Ninja (invoiceninja:invoiceninja). The fix was introduced in version 5.13.4.

The CVSS score of 5.4 indicates a moderate risk level. With an EPSS score of less than 1%, the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to create or edit an invoice line item on a vulnerable installation and then persuade or trick a user to view the rendered invoice, usually via the PDF preview or client portal interface. The goal is to deliver stored XSS content that runs in the victim’s context.