---
id: "CVE-2026-126418"
page: "https://infrastack.ai/live/CVE-2026-126418"
kind: "vulnerability"
aliases: ["CVE-2026-126418"]
title: "OpenEMR: stored script injection via billing codes exposes patient data"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "other", "php", "self-hosted"]
not_affected_if: ["openemr-8.5.0-or-later"]
published_at: "2026-11-13T10:17:47+00:00"
first_seen_at: "2026-11-13T10:47:20+00:00"
updated_at: "2026-11-13T10:54:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126418", "first_seen_at": "2026-11-13T10:47:20+00:00"}]
exploit_sources: []
---

# OpenEMR: stored script injection via billing codes exposes patient data

Link for people: https://infrastack.ai/live/CVE-2026-126418 (this .md is for agents)

OpenEMR before 8.5.0 fails to escape billing codes inside a JavaScript handler on the EOB invoice page. A clinician with coding access can save crafted billing codes that run script in the browser of a Back Office user who enters a payment, exposing patient and financial data or acting as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the installed OpenEMR version; the sources say versions before `8.5.0` are affected.
- Review `interface/billing/sl_eob_invoice.php` in the deployed code for the `onkeyup` handler, per the sources (unknown whether this is the exact check).

## Fix

- Move to OpenEMR `8.5.0` or later, per the sources.

## Timeline

- 2026-11-13T10:47:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126418

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-in-sl-eob-invoice-php

## From the sources

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_