Grocy’s API request‑body parser sanitizes incoming values with HTMLPurifier, but then manually reverses the entity encoding of the purified output. The double‑decode reinstates raw HTML and script tags that were originally neutralized. This flaw permits an attacker to store malicious content in any API‑writable field—products, recipes, stock, users, chores, and others—leading to stored XSS when the data is later rendered without re‑sanitization. The resulting compromise allows arbitrary code execution in the browsers of any user viewing the affected page, threatening confidentiality, integrity, and availability of the application’s users and data.

The vulnerability affects installations of Grocy across all modules that accept API input for text fields. All current versions lacking the double‑decode fix are potentially exploitable until a patch is applied. No specific version information is available, so administrators should assume all released releases are vulnerable until confirmed otherwise.

With a CVSS score of 8, the issue is classified as high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw via the network by sending crafted API requests that include script tags; attackers do not need elevated privileges beyond write access to the vulnerable fields. The effect is the execution of malicious scripts in the context of any user who views the stored data.