Executive brief
FacturaScripts, an open-source ERP and CRM, is vulnerable to a security flaw where malicious code can be stored in product or account fields. When an administrative user interacts with certain selection menus (widgets), this code executes in their browser. This could allow a low-privileged user to steal session information or perform actions on behalf of an administrator.
Technical details
A Stored XSS vulnerability exists in FacturaScripts <= 2026.1 within `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`. The application attempts to sanitize input using `Tools::noHtml`, which converts quotes to HTML entities (e.g., '). However, because these values are placed inside an HTML `onclick` attribute, the browser decodes the entities before the JavaScript is executed, allowing an attacker to break out of the string literal and execute arbitrary JS. Attackers can plant payloads via product references or subaccount codes through the UI, API, or direct database access. The vulnerability is triggered when a user opens a modal containing the malicious entry and clicks the affected row.
Affected products
- NeoRazorX facturascripts <= 2026.1
Timeline
- 2026-07-14: advisory: GHSA-3x7p-v8hj-xh5m published