OPENEMR · CVE-2026-126418 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 fails to escape billing codes inside a JavaScript handler on the EOB invoice page. A clinician with coding access can save crafted billing codes that run script in the browser of a Back Office user who enters a payment, exposing patient and financial data or acting as that user.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and hospitals running OpenEMR before 8.5.0 where users have encounter coding access and Back Office users record payments. The flaw needs a clinician with coding rights to plant the payload, and a Back Office user to trigger it. Installations already on 8.5.0 or later are not affected.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 are affected.interface/billing/sl_eob_invoice.php in the deployed code for the onkeyup handler, per the sources (unknown whether this is the exact check).8.5.0 or later, per the sources.OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.