Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 26, 2026 · NIST NVD

   Detected

   Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through before rendering. This is fixed in v5.13.4 by the v

2. Jun 17, 2026 · NIST NVD

   Updated

   Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through before rendering. This is fixed in v5.13.4 by the v

Affected

• cpe invoiceninja/invoice ninjaversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33628

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33628

  Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or c

  nvd.nist.gov

References

• Patch · github.com
• Release Notes · github.com
• Vendor Advisory · github.com