CVE-2026-14791: Crater Invoice XSS Vulnerability in Notes Handler

Technical summary

The vulnerability resides in the getFormattedString function within app/Http/Requests/InvoicesRequest.php, which processes the notes parameter of the Invoice Note Handler component. Insufficient input validation and output encoding allow an authenticated attacker to inject arbitrary JavaScript that executes in a victim's browser session. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) reflects remote network access, low attack complexity, and the requirement for an authenticated user and victim interaction. The weakness maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code), indicating both direct XSS and dynamic code execution concerns.

Business impact

In environments where Crater Invoice is used to manage client communications and financial records, this vulnerability could allow an attacker with system access to modify invoice notes containing malicious links or scripts that redirect users to phishing sites, steal session tokens, or harvest credentials. The impact is limited by the need for user interaction and authenticated access, but the presence of public exploit code increases practical risk. Organizations relying on invoice data integrity and user trust may face reputation damage if compromised invoices are distributed to customers.

Affected systems

Crater Invoice versions up to and including 6.0.6 are affected. The vulnerability is in a core request handling component, meaning any deployment processing invoice notes through the standard web interface is potentially vulnerable. Verify your installed version against the vendor's release history.

Exploitability

The vulnerability is remotely exploitable but constrained by two practical factors: the attacker must have valid application credentials (login access) and the target user must interact with a malicious note (e.g., click a link or view the invoice). Public exploit code is available, reducing the barrier to attack for adversaries with legitimate access. The low CVSS score reflects these constraints, but availability of working exploits makes this a live threat that should not be dismissed.

Remediation

Immediately check your Crater Invoice deployment version. If running version 6.0.6 or earlier, review the vendor's official repository and advisory channels for patched releases. In the interim, restrict invoice note editing permissions to trusted administrators, and implement input validation or Web Application Firewall rules to block suspicious script patterns in the notes field. Consider enabling Security Content Security Policy (CSP) headers to limit the impact of any injected script.

Patch guidance

Verify the latest stable release from the Crater Invoice project repository for a patched version addressing CWE-79 sanitization. The vendor was notified early but has not yet released a public advisory with specific patch version details; consult the official GitHub repository or vendor documentation for the recommended upgrade path. Apply patches in a test environment before production deployment.

Detection guidance

Monitor for HTTP POST requests to invoice endpoints with suspicious payloads in the notes parameter—look for script tags, JavaScript event handlers (onerror, onload), or encoded variants. Inspect browser-based activity logs for users accessing invoices with unusual note content. If you maintain web server logs, search for patterns like '%3Cscript%3E', 'javascript:', or 'onerror=' in invoice-related requests. Consider using a WAF to alert on known XSS payload signatures in the notes field.

Why prioritize this

Although the CVSS score is low (3.5), the availability of public exploit code, combined with the vulnerability's presence in a financial/invoicing workflow, merits prompt attention. The damage (integrity impact to invoice records, phishing vectors to users) outweighs the formal severity rating, especially if your Crater Invoice instance handles customer-facing documents. Prioritize this above purely theoretical vulnerabilities, but below critical RCE or authentication bypass issues.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) is driven by the requirement for authentication (PR:L) and user interaction (UI:R), which significantly reduce real-world likelihood compared to an unauthenticated, no-interaction XSS. However, the integrity impact (I:L) and public availability of working exploits elevate practical risk. Organizations with high-volume multi-user Crater deployments or those handling sensitive client invoices should weight this higher than the numeric score suggests.

Frequently asked questions