CVE-2026-33742: Invoiceninja Invoice Ninja

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output.

Affected products

• Invoiceninja Invoice Ninja: before 5.13.4 (fixed in 5.13.4)

Published 2026-03-26. Last modified 2026-06-17.