CVE-2026-33742
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.
Published Mar 26, 2026 · updated Jun 17, 2026 · invoiceninja invoice ninja
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding to sanitize Markdown output.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding to sanitize Markdown output.
Jun 17, 2026 · NIST NVD
Updated
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding to sanitize Markdown output.
Affected
- cpe invoiceninja/invoice ninjaversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33742
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33742
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with befo
nvd.nist.gov