CVE-2026-23997: FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View

February 2, 2026 (updated February 3, 2026)

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

References

github.com/NeoRazorX/facturascripts
github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h
github.com/advisories/GHSA-4v7v-7v7r-3r5h
nvd.nist.gov/vuln/detail/CVE-2026-23997

Code Behaviors & Features

Detect and mitigate CVE-2026-23997 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →