Invoiceninja EUVD-2026-16418

Invoice Ninja is a Laravel-based invoicing application (CPE: cpe:2.3:a:invoiceninja:invoiceninja) that processes product notes fields through a Markdown rendering pipeline. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize Markdown parser output before template inclusion. The application used Markdown conversion to render rich text in product notes but did not subsequently pass the HTML output through purification routines. This is a classic second-order XSS pattern where user-controlled Markdown input is converted to HTML and then embedded in templates without Content Security Policy or HTML entity encoding protections. The fix implements the purify::clean() function, which is a standard Laravel/PHP HTML sanitization utility that strips potentially dangerous tags and attributes while preserving safe formatting.