OPENEMR · CVE-2026-126450 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets an authenticated user save a script in the patient External ID field. The script runs in the browser of any other user who opens that patient's prescriptions through View Printable Version (HTML).
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR installation before 8.5.0 where logged-in users can edit patient External ID values and other users view prescriptions through the printable HTML view. Sources do not say whether managed or hosted deployments are exposed by default.
Not affected if version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected.8.5.0 or later (fixed version per the NVD description).OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.