CVE-2026-14791 describes a cross-site scripting vulnerability in the crater invoicing application, affecting versions 6.0.0 to 6.0.6. The vulnerability resides in the getFormattedString function within app/Http/Requests/InvoicesRequest.php, part of the Invoice Note Handler component. An attacker can manipulate the notes argument to inject malicious scripts, potentially executing them in the context of a victim's browser. The vulnerability is remotely exploitable and a public exploit exists. The vendor has not issued a patch or official remediation at the time of this report.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required. There is no indication of privilege escalation or direct impact on server confidentiality or integrity.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider applying input validation or output encoding workarounds on the notes input if feasible. Avoid exposing the vulnerable functionality to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.