CVE Intelligence
Analysis AI-assisted

CVE-2026-23997: FacturaScripts Stored XSS in Observations Field (History View)

CVE-2026-23997 is a stored cross-site scripting flaw in FacturaScripts 2025.71 and earlier, triggered through the Observations field and rendered without HTML entity encoding in the History view. NVD scores it 9 (CVSS 3.1, critical) and GitHub scores it 8. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-23997 is a stored XSS issue in FacturaScripts, an open-source ERP and accounting application. According to the record, content from the Observations field is displayed in the History view without proper HTML entity encoding, so stored data can be interpreted as active browser content.

Impact

  • According to the record, arbitrary JavaScript can run in the browser of administrators who view the history.
  • NVD rates the issue 9 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, which marks confidentiality, integrity and availability impact as High and scope as changed.
  • GitHub rates the same issue 8 under CVSS 3.1.
  • Because the flaw is stored, exposure persists for as long as the malicious content remains in the data and is viewed by privileged users.

Affected products and versions

  • Product listed as FacturaScripts Facturascripts, with the affected range given as earlier than 2025.71.
  • The description states that 2025.71 and earlier are affected. This difference between the description and the affected range is not resolved by the available data.
  • The record lists no fixed version.

Exploitation status

  • The record does not list this CVE in CISA KEV, so it is not described as active exploitation in the sources consulted.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The GitHub reference is tagged Exploit in the record. That tag does not establish that exploitation has occurred.

Remediation and mitigation

  • The record lists no fixed version. Check the GitHub security advisory for vendor guidance and upgrade to a release the vendor documents as fixed.
  • Until a fix is applied, limit access to the History view and the Observations field to trusted users, and review who holds administrator rights.
  • Review existing Observations entries for unexpected HTML or script-like content and remove suspicious entries after evaluation.
  • Apply a strict Content Security Policy where the application supports it, to reduce the impact of injected scripts.
  • Ensure administrators log out of sessions on shared or untrusted machines.

Detection guidance

  • Review application records for Observations entries containing HTML tags or script-like markup that were not entered by authorized staff.
  • Monitor administrator activity for unexpected changes to records or configuration after viewing the history.
  • Keep web server and application logs for review when investigating suspicious entries.

Limitations of the available information

  • No fixed version is listed in the record.
  • The description and the affected range differ on the upper boundary (2025.71 and earlier versus earlier than 2025.71).
  • No EPSS score or SSVC data is available in the record.
  • The record does not include a title, so the title in this analysis was written from the description.
  • Sources consulted are the NVD entry and the GitHub advisory, which contain limited technical detail.

Frequently asked questions

Which versions of FacturaScripts are affected by CVE-2026-23997?

The description says version 2025.71 and earlier are affected, while the affected range in the record is earlier than 2025.71. The available data does not resolve this difference, so check the vendor advisory before concluding.

Is this vulnerability being actively exploited?

The record does not list CVE-2026-23997 in CISA KEV, and no confirmed exploitation appears in the sources consulted. The GitHub reference carries an Exploit tag, but that tag alone does not show in-the-wild use.

What should administrators do now?

The record lists no fixed version. Limit access to the History view, review Observations entries for suspicious markup, and upgrade to a release the vendor documents as fixed once one is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.