InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resou…

InvoiceNinja v5-stable contains a stored Cross-Site Scripting (XSS) vulnerability in the invoice/quote 'terms' field. The client portal renders this field using Laravel Blade's raw output directive without any HTML sanitization. The StoreInvoiceRequest.php validation only strips newlines and does not purify HTML content. An authenticated user with invoice creation access can inject malicious HTML/JavaScript payloads via the REST API endpoint PUT /api/v1/invoices/{id}. When a client views the invoice in the portal, the payload executes in their browser. This can lead to session cookie theft and full client account takeover. This vulnerability is distinct from a previously disclosed XSS in the invoice line-item description field (CVE-2026-33628 / GHSA-98wm-cxpw-847p), representing a separate vulnerable code path.