CVE-2026-14791 describes a cross-site scripting vulnerability in crater-invoice-inc crater affecting versions 6.0.0 to 6.0.6. The vulnerability is located in the getFormattedString function within the Invoice Note Handler component (app/Http/Requests/InvoicesRequest.php). An attacker can manipulate the notes argument to inject malicious scripts, potentially executing code in the context of the victim's browser. The vulnerability can be exploited remotely without elevated privileges. The project was notified early but has not issued a response or fix. The CVSS 4.0 base score is 5.1, indicating medium severity.

Successful exploitation allows an attacker to perform cross-site scripting attacks by injecting malicious scripts through the notes argument. This can lead to execution of arbitrary scripts in the context of users interacting with the vulnerable component, potentially resulting in session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction (UI:P) and low privileges (PR:L) but no user consent or elevated privileges are needed. There is no indication of confidentiality, integrity, or availability impact beyond the XSS vector.

No official patch or remediation has been announced by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding on the notes parameter as a temporary mitigation. Monitor vendor channels for updates and apply official patches once released.