The vulnerability in Grocy's API request-body parser (specifically in controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) arises because after purifying incoming field values with HTMLPurifier, the code manually reverses HTML entity encoding by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and &. This double-decoding negates the neutralization performed by HTMLPurifier, effectively reconstructing live HTML/script tags that enable stored XSS attacks. These attacks can occur across various API-writable fields that are later rendered without additional sanitization.

Successful exploitation allows an attacker with API write privileges to inject malicious scripts into fields such as products, recipes, stock, users, and chores. These scripts execute in the context of users viewing the affected data, compromising confidentiality and integrity by enabling actions like session hijacking or unauthorized actions. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using API endpoints that accept user input for affected fields or implement additional sanitization on the server side before rendering. Monitor vendor channels for official patches or updates addressing this issue.