InvenTree project: stored cross-site scripting in InvenTree markdown notes

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addressed as follows: 1. HTML sanitization has been enabled in the front-end markdown rendering library - easymde. 2. Stored markdown is also validated on the backend, to ensure that malicious markdown is not stored in the database. These changes are available in release versions 0.16.5 and later. All users are advised to upgrade. There are no workarounds, an update is required to get the new validation functions.

The InvenTree project marks InvenTree versions < 0.16.5 as affected. The vendor advisory lists 0.16.5 and 0.17.0 as patched versions. The status of other release branches or parallel versions is not established by these sources, so the safety of every later version should not be inferred automatically.

The InvenTree project allowed a registered user to store JavaScript in Markdown notes fields. When the note was rendered on the same page, the stored script could execute in the browser of another logged-in user who visited that page. The defect was in insufficient neutralization of Markdown content in the frontend rendering path and insufficient validation before the content was stored in the database. The fix enables HTML sanitization in easymde and adds backend validation to prevent malicious Markdown from being stored. The attack properties in the record characterize the path as network-reachable, requiring a registered account, low complexity, and a logged-in user to visit the affected page. Public details do not identify every affected endpoint or the exact Markdown payload format.

The vulnerability is remotely reachable through the application's network-accessible interface or endpoints. An attacker needs the privileges of a registered user to store malicious Markdown, and another logged-in user must visit the page containing the note. The record characterizes exploitation complexity as low and user interaction as required. No public exploit is recorded in the supplied record; that status does not prove that exploitation has never occurred.

The stored XSS executes in a logged-in user's browser when that user visits a page containing the affected note. The practical outcome depends on the victim's permissions, but may include reading accessible data, modifying data, or performing actions within the victim's authorization scope. The record indicates high potential confidentiality and integrity impact, while availability is not identified as a direct impact. User interaction is required because a user must open the affected page, so merely running the vulnerable server does not mean every account is immediately affected.

The flaw puts other InvenTree users' browser sessions at risk when they view a page containing a malicious note. Code running in a victim's browser could read or alter data that the victim is authorized to access and could perform actions through the victim's permissions, subject to the application's defenses. This can affect the confidentiality and integrity of inventory-management data and related operations. The record does not confirm a breach, a specific victim, or access to any particular data.

1. Upgrade InvenTree to a vendor-listed patched release: 0.16.5 or 0.17.0, according to the deployment branch.
2. If another branch is in use, verify the status of that specific branch with the vendor before treating it as unaffected.
3. No workaround is provided by the vendor; an update is required to obtain the new frontend and backend validation functions.
4. After upgrading, review existing Markdown notes and assess whether suspicious content needs to be removed or replaced. The advisory does not confirm that upgrading automatically deletes malicious content stored before the update.
5. Verify in the deployed environment that easymde HTML sanitization and backend Markdown validation are active.

1. Inventory all InvenTree deployments and determine the version actually running in each environment.
2. Identify deployments in the affected range < 0.16.5 and prioritize them for immediate remediation. When automating the check, do not include the explanatory whitespace between the backticks and the version operator in the comparison value.
3. Review stored Markdown notes for unexpected content that appears to contain script or unsafe HTML. This is a precautionary review, not a vendor-confirmed IOC.
4. Review application and access logs for unusual note-editing activity or sessions visiting pages containing suspicious notes. Public sources do not define a specific log event or IOC.
5. Do not treat the absence of suspicious content or log activity as proof that the deployment is safe.