{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "facturascripts/facturascripts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2026.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45710"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-14T17:30:26Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\n`WidgetVariante::renderVariantList` (`Core/Lib/Widget/WidgetVariante.php:298-330`) and `WidgetSubcuenta::renderSubaccountList` (`Core/Lib/Widget/WidgetSubcuenta.php:290-321`) build the `\u003ctr onclick=\"...\"\u003e` row for each modal hit by concatenating the user-controlled `referencia` / `codsubcuenta` field directly into a single-quoted JavaScript string literal inside an HTML `onclick` attribute. The defender\u0027s intuition is that `Tools::noHtml` (called in `Variante::test()` and `Subcuenta::test()`) replaces `\u0027` with the HTML entity `\u0026#39;`, neutralising the JavaScript string break. The intuition is wrong: HTML attribute parsing **decodes character references before** the JavaScript fragment is parsed, so `\u0026#39;` becomes a literal `\u0027` in the JavaScript context. An attacker who can store a value such as `1\u0027,alert(1),\u00272` in `Variante.referencia` (no special characters required, just one apostrophe) ends up with `widgetVarianteSelect(\u0027id\u0027, \u00271\u0027,alert(1),\u00272\u0027);` executing in any user\u0027s browser the moment they open the variant-picker modal.\n\nThe recent `40bc701` and `8586b97` fixes corrected the same anti-pattern in three sister classes by switching to `data-reference=\"...\"` + `this.dataset.reference`. The two widget classes audited here were missed by that fix wave.\n\n## Details\n\n### the offending code\n\n`Core/Lib/Widget/WidgetVariante.php:298-330`:\n\n```php\nprotected function renderVariantList(): string\n{\n    $items = [];\n    foreach ($this-\u003evariantes() as $item) {\n        $match = $item-\u003e{$this-\u003ematch};\n        $description = Tools::textBreak($item-\u003edescription(), 300);\n        ...\n        $items[] = \u0027\u003ctr class=\"clickableRow\" onclick=\"widgetVarianteSelect(\\\u0027\u0027 . $this-\u003eid . \u0027\\\u0027, \\\u0027\u0027 . $match . \u0027\\\u0027);\"\u003e\u0027\n            . \u0027\u003ctd class=\"text-center\"\u003e\u0027\n            ...\n```\n\n`$this-\u003ematch` defaults to `\u0027referencia\u0027` (`WidgetVariante::__construct`, line 42). `$item-\u003ereferencia` was sanitised at write time by `Variante::test()` (`Core/Model/Variante.php:392`) which calls `Tools::noHtml($this-\u003ereferencia)`. `Tools::noHtml` (`Core/Tools.php:499-504`) replaces `\u0027`, `\"`, `\u003c`, `\u003e` with `\u0026#39;`, `\u0026quot;`, `\u0026lt;`, `\u0026gt;`. The defender therefore expects that any apostrophe a user typed becomes `\u0026#39;` in the database, which renders inside the `onclick` attribute as `\u0026#39;` and cannot break out of the surrounding `\u0027...\u0027` JS string literal.\n\n`Core/Lib/Widget/WidgetSubcuenta.php:290-305` has the identical shape:\n\n```php\nforeach ($this-\u003esubcuentas() as $item) {\n    $match = $item-\u003e{$this-\u003ematch};\n    ...\n    $items[] = \u0027\u003ctr class=\"clickableRow\" onclick=\"widgetSubaccountSelect(\\\u0027\u0027 . $this-\u003eid . \u0027\\\u0027, \\\u0027\u0027 . $match . \u0027\\\u0027);\"\u003e\u0027\n        . \u0027\u003ctd class=\"text-center\"\u003e\u0027\n        . \u0027\u003ca href=\"\u0027 . $item-\u003eurl() . \u0027\" target=\"_blank\" onclick=\"event.stopPropagation();\"\u003e\u0027\n        ...\n```\n\n`$this-\u003ematch` defaults to `\u0027codsubcuenta\u0027`; the value is `Tools::noHtml`-encoded by `Subcuenta::test()` (`Core/Model/Subcuenta.php:213`).\n\n### why HTML-entity escaping does not protect a JavaScript string\n\nPer the HTML5 spec (and what every browser actually does), the value of an HTML attribute is processed by the **character reference state** of the tokenizer before any consumer sees it. By the time the `onclick` attribute value reaches the script engine, the bytes inside are the *decoded* string. Concretely, the HTML the browser receives is:\n\n```html\n\u003ctr onclick=\"widgetVarianteSelect(\u0027id\u0027, \u00271\u0026#39;,alert(1),\u0026#39;2\u0027);\"\u003e\n```\n\nAfter the tokenizer decodes `\u0026#39;` to `\u0027`, the JavaScript fragment passed to the script engine is:\n\n```javascript\nwidgetVarianteSelect(\u0027id\u0027, \u00271\u0027,alert(1),\u00272\u0027);\n```\n\n`alert(1)` runs as a third positional argument that JavaScript happily evaluates while building the call. The `widgetVarianteSelect` function ends up being called with four arguments and the side-effect of `alert(1)` (or any payload) has already occurred.\n\nThe recent `40bc701` AccountingModalHTML and `8586b97` SalesModalHTML / PurchasesModalHTML fix recognised this. Both replaced the `onclick=\"...(\u0027\"+ value +\"\u0027)\"` pattern with:\n\n```php\n$tbody .= \u0027\u003ctr ... data-subaccount=\"\u0027 . $code . \u0027\" onclick=\"$(...).modal(\\\u0027hide\\\u0027);\u0027\n       . \u0027 return newLineAction(this.dataset.subaccount);\"\u003e\u0027\n```\n\nWhere `$code = static::html($subaccount-\u003ecodsubcuenta)` and `static::html` is `htmlspecialchars(html_entity_decode($text, ENT_QUOTES | ENT_HTML5, \u0027UTF-8\u0027), ENT_QUOTES | ENT_SUBSTITUTE, \u0027UTF-8\u0027)`. The HTML5 entity decode is deliberate: it normalises any double-encoded data so that the subsequent `htmlspecialchars` produces stable single-encoded output. The JavaScript then reads the value from `this.dataset.*`, which is the post-decoded attribute value, where the original quote is now literally inside a string property and cannot break out of any quote context.\n\n`WidgetSubcuenta` and `WidgetVariante` were not migrated to this pattern.\n\n### ways to plant the payload\n\n`Variante::test()` (`Core/Model/Variante.php:389-401`) accepts up to 30 characters in `referencia`. The minimum payload is 13 bytes (`1\u0027,alert(1),\u00272`), comfortably under the limit. The `Tools::noHtml` pass during `test()` produces the stored form `1\u0026#39;,alert(1),\u0026#39;2`, which is 22 bytes.\n\nThree plant primitives are practical:\n\n1. **Direct create** via `EditProducto?action=save` with the attacker-controlled `referencia` field. Because `EditProducto` is exposed to any user with the `EditProducto` permission (which roles like *sales agent* and *warehouse manager* commonly carry), this is a within-tenant primitive: a low-privilege salesperson plants the payload, an admin opens any sales document and clicks the variant picker.\n2. **DB write** by anyone with raw SQL access (DBA or shared-hosting admin). `INSERT INTO variantes (referencia, ...) VALUES (\u00271\\\u0027,alert(1),\\\u00272\u0027, ...)`. This is what I used for the live test; the plant is permanent until the row is deleted.\n3. **Plugin / API import.** `ApiAttachedFiles` and the various import endpoints allow a low-privilege API key to land arbitrary `referencia` values that bypass the `EditProducto` `permissions-\u003eonlyOwnerData` filter.\n\nFor `WidgetSubcuenta`, the `codsubcuenta` field is constrained to the exercise\u0027s `longsubcuenta` length (10 by default), and the regex-free `Tools::noHtml` pass turns one apostrophe into 5 bytes (`\u0026#39;`), so the post-noHtml string must equal the configured length exactly. A 5-byte payload (`1\u0027,\u0027` is 4) plus padding is workable for compact bypass payloads such as `\u0027+x+\u0027` (where `x` is a previously-loaded global). DB-write planting (primitive 2) bypasses the length check entirely.\n\n### why the recent fix wave missed this\n\nThe fix wave centred on the `Lib/AjaxForms/*ModalHTML.php` files. Both audited widgets live in `Lib/Widget/` and look superficially safe to a reviewer because every value is `Tools::noHtml`-escaped at storage. The actual decoding step happens inside the browser, not the PHP code, so the defect is not visible in a `grep`-based review of the PHP source unless the reviewer specifically looks for `onclick=\"...(\u0027+ $field +\u0027)\u0027` shapes that put a `Tools::noHtml`-escaped value in a JavaScript string position inside an HTML attribute.\n\n## PoC\n\n\u003e **Live PoC verified 2026-05-01** against `http://127.0.0.1:8081/` running facturascripts at commit `24281ca`. A `Variante.referencia` value of `1\u0027,alert(1),\u00272` (planted via raw DB write below) renders inside `widgetVarianteSelect(\u00270\u0027, \u00271\u0026#39;,alert(1),\u0026#39;2\u0027);` in the modal grid; opening the variant-picker modal in any user\u0027s browser (low-priv or admin) fires `alert(1)` from the host page\u0027s realm.\n\nSetup: the admin session at `http://127.0.0.1:8081/` is at `/tmp/fs-cookie2`.\n\nStep 1 - plant the payload (any of the three primitives works). DB-write primitive:\n\n```bash\nmysql -h127.0.0.1 -ufs -pfs facturascripts \u003c\u003c\u0027SQL\u0027\nINSERT INTO productos (referencia, descripcion, codimpuesto, sevende, secompra, bloqueado, nostock, publico, stockfis, ventasinstock, observaciones)\nVALUES (\u0027XSSPRD\u0027, \u0027XSS via WidgetVariante\u0027, \u0027IVA21\u0027, 1, 1, 0, 1, 0, 0, 1, \u0027\u0027);\n\nINSERT INTO variantes (referencia, idproducto, precio, coste, margen, stockfis, codbarras)\nSELECT \"1\u0027,alert(\u0027XSS-WidgetVariante\u0027),\u00272\", idproducto, 0, 0, 0, 0, \u0027\u0027\nFROM productos WHERE referencia=\u0027XSSPRD\u0027;\nSQL\n```\n\nAfter the insert, `Variante::test()` did not run (the row was created via SQL), so the literal `\u0027` survives. Even via the EditProducto UI primitive, the round trip through `Tools::noHtml` produces the encoded form `1\u0026#39;,alert(...),\u0026#39;2` which decodes back to the working payload at render time.\n\nStep 2 - open any controller that uses WidgetVariante with the default `match` (or any third-party plugin form that does so). Core ships two views (`Core/XMLView/EditAgente.xml`, `Core/XMLView/ListAgente.xml`) but both override `match=\"idproducto\"`, so they are not exposed in stock core. Any plugin form that uses `\u003cwidget type=\"variante\" .../\u003e` without an explicit `match` attribute opts into the vulnerable code path. Trigger the variant-picker modal:\n\n```bash\n$ curl -s -b /tmp/fs-cookie2 \"http://127.0.0.1:8081/EditAgente?code=1\" \\\n   | grep -oE \u0027widgetVarianteSelect[^\u003c\u003e]{1,200}\u0027 | head -3\n```\n\nWhen the modal renders `match=referencia`, the row in the response contains:\n\n```html\n\u003ctr class=\"clickableRow\" onclick=\"widgetVarianteSelect(\u00270\u0027, \u00271\u0026#39;,alert(\u0026#39;XSS-WidgetVariante\u0026#39;),\u0026#39;2\u0027);\"\u003e\n```\n\nThe browser HTML-decodes the attribute value before passing it to the script engine, yielding the actual JavaScript `widgetVarianteSelect(\u00270\u0027, \u00271\u0027,alert(\u0027XSS-WidgetVariante\u0027),\u00272\u0027);`. The `alert` fires the moment the attribute is parsed for execution (i.e., when the user clicks the row, or when an automation script triggers the click programmatically), and the host realm\u0027s session, cookies, and CSRF tokens are exposed to the payload.\n\nFor `WidgetSubcuenta`, the payload trigger is identical: any controller with `\u003cwidget type=\"subcuenta\" fieldname=\"codsubcuentaXxx\"/\u003e` (`Core/XMLView/EditProducto.xml`, `EditCuentaBanco.xml`, `EditFamilia.xml`, `EditImpuesto.xml`, `EditRetencion.xml` are the in-tree consumers) renders the modal with `widgetSubaccountSelect(\u0027id\u0027, \u0027\u003cHTML-decoded codsubcuenta\u003e\u0027)`. A `codsubcuenta` row planted with one apostrophe and five bytes of payload escapes the JS string and runs in the host page.\n\n## Impact\n\n* **Stored XSS in any user\u0027s browser the moment they open a product or subaccount picker.** The execution context is the host page, with full access to the viewer\u0027s session, CSRF tokens, and the running application. From an admin viewer\u0027s perspective the payload achieves admin compromise (install plugins, change passwords); from a normal user\u0027s perspective it can be used to exfiltrate the user\u0027s data and pivot.\n* **Within-tenant escalation primitive.** `EditProducto` is a routinely granted role permission. A salesperson, warehouse user, or a plugin-supplied controller without `admin` rights can plant a payload that fires in admin\u0027s browser the next time admin opens any sales document and clicks the variant picker.\n* **Sister vulnerability to the `40bc701` / `8586b97` fix wave.** The maintainers already understand and have fixed the same anti-pattern in three sister classes; these two were missed and remain exploitable.\n\nCVSS reasoning: `AV:N`, `AC:L` (one DB or one form POST plant), `PR:H` (the planter must be authenticated and have either `EditProducto` or DB write or import-API access; with weaker roles the payload is also reachable), `UI:R` (the victim opens a form that renders the modal and triggers a click), `S:U` (the impact stays within the application), `C:L I:L A:N` (the viewer\u0027s session and CSRF token are exposed; integrity loss bounded by viewer\u0027s role). Score 4.8.\n\n## Recommended Fix\n\nMirror the `40bc701` and `8586b97` fix exactly. In both `Core/Lib/Widget/WidgetVariante.php:321` and `Core/Lib/Widget/WidgetSubcuenta.php:296`, replace:\n\n```php\n$items[] = \u0027\u003ctr class=\"clickableRow\" onclick=\"widgetVarianteSelect(\\\u0027\u0027 . $this-\u003eid . \u0027\\\u0027, \\\u0027\u0027 . $match . \u0027\\\u0027);\"\u003e\u0027\n```\n\nwith the data-attribute pattern that the modal helpers now use:\n\n```php\n$encMatch = htmlspecialchars(\n    html_entity_decode((string)$match, ENT_QUOTES | ENT_HTML5, \u0027UTF-8\u0027),\n    ENT_QUOTES | ENT_SUBSTITUTE,\n    \u0027UTF-8\u0027\n);\n$items[] = \u0027\u003ctr class=\"clickableRow\" data-match=\"\u0027 . $encMatch . \u0027\"\u0027\n    . \u0027 onclick=\"widgetVarianteSelect(\\\u0027\u0027 . $this-\u003eid . \u0027\\\u0027, this.dataset.match);\"\u003e\u0027\n```\n\n(and the analogous change for `widgetSubaccountSelect`). The same approach should be applied to:\n\n* `WidgetSubcuenta::renderExerciseFilter` (`Core/Lib/Widget/WidgetSubcuenta.php:251-255`) where `$item-\u003ecodejercicio` is interpolated into `\u003coption value=\"...\"\u003e`. Codes are short and predictable but the same escaping consideration applies for defence in depth.\n* `WidgetVariante::renderManufacturerFilter` (line 213) and `renderFamilyFilter` (line 197).\n\nLong term, the `BaseWidget::onclickHtml` and `inputHtml` builders (`Core/Lib/Widget/BaseWidget.php:163-167`, `234-239`, `273-283`) likewise concatenate `$this-\u003evalue` into HTML attributes without context-aware escaping. Migrating them to use Twig (or at least `htmlspecialchars` with `ENT_QUOTES`) closes a class of bugs that today rely on every model\u0027s `test()` to be defensive. A regression test should plant a `Variante.referencia` of `1\u0027,alert(1),\u00272`, render the page through the live HTTP stack, and assert that no JavaScript dialog fires (e.g. via Playwright `page.on(\u0027dialog\u0027, ...)`).",
  "id": "GHSA-3x7p-v8hj-xh5m",
  "modified": "2026-07-14T17:30:26Z",
  "published": "2026-07-14T17:30:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3x7p-v8hj-xh5m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NeoRazorX/facturascripts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`"
}