InvoiceNinja v5-stable renders the "terms" field of invoices or quotes in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} without sanitizing HTML content. The StoreInvoiceRequest.php component only removes newlines but does not purify or escape HTML. Consequently, an authenticated user with access to create or modify invoices can supply a malicious HTML/JavaScript payload via the REST API endpoint PUT /api/v1/invoices/{id}. This payload executes in the browser of clients viewing the invoice, enabling cross-site scripting attacks that can lead to session cookie theft and client account compromise. This vulnerability is tracked as CVE-2026-71233 and is separate from the previously disclosed invoice line-item description XSS (CVE-2026-33628).

Successful exploitation allows an authenticated user with invoice creation privileges to inject malicious scripts into the "terms" field of invoices or quotes. When clients view these invoices in the portal, the injected scripts execute in their browsers, potentially stealing session cookies and enabling client account takeover. The vulnerability has a high severity score (CVSS 8.7) due to its ability to compromise client accounts and data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict invoice creation permissions to trusted users only and avoid entering untrusted content into the "terms" field. Monitor vendor communications for updates regarding patches or official mitigations.