Impact

In affected version(s) of InvenTree it is possible for a registered user to store XSS in markdown notes fields, which are then displayed to other logged in users who visit the same page.

Mitigations

The vulnerability has been addressed as follows:

• HTML sanitization has been enabled in the front-end markdown rendering library - easymde
• Stored markdown is also validated on the backend, to ensure that malicious markdown is not stored in the database

Patches

The following version of InvenTree have been patched against this vulnerability:

• 0.17.0
• 0.16.5

Workarounds

There are no workarounds, an update is required to get the new validation functions.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.