{"id":"CVE-2026-126450","kind":"vulnerability","aliases":["CVE-2026-126450"],"related":[],"title":"OpenEMR: stored XSS in patient External ID runs script for other users","description":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions.","summary":"OpenEMR before 8.5.0 lets an authenticated user save a script in the patient External ID field. The script runs in the browser of any other user who opens that patient's prescriptions through View Printable Version (HTML).","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review whether users can edit the patient External ID field and whether prescription printable views render it unescaped.","fix":"- OpenEMR: move to `8.5.0` or later (fixed version per the NVD description).","status":"open","published_at":"2026-11-13T10:17:52+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","triaged_at":"2026-11-13T10:57:11+00:00","updated_at":"2026-11-13T10:57:11+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:57:11Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (fixed version per the NVD description).","reach":"network","title":"OpenEMR: stored XSS in patient External ID runs script for other users","impact":"medium","summary":"OpenEMR before 8.5.0 lets an authenticated user save a script in the patient External ID field. The script runs in the browser of any other user who opens that patient's prescriptions through View Printable Version (HTML).","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in other users' browser sessions, exposing clinical data","analyst_note":"Confirm the fixed version and vendor advisory details at the GitHub advisory link; the NVD text alone does not confirm the full affected range.","how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review whether users can edit the patient External ID field and whether prescription printable views render it unescaped.","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Any OpenEMR installation before 8.5.0 where logged-in users can edit patient External ID values and other users view prescriptions through the printable HTML view. Sources do not say whether managed or hosted deployments are exposed by default.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000743,"input_tokens":4598,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126450':15A,18A '-2026':14A,17A '8.5.0':28B,65C 'allow':75C 'authent':31B,76C 'browser':47B,110C 'contain':66C 'cross':70C 'cross-sit':69C 'cve':13A,16A 'execut':92C 'extern':6A,39B,87C 'field':41B,89C 'healthcar':20B 'host':25B 'html':62B,105C 'id':7A,40B,88C 'inject':79C 'let':29B 'open':53B,96C 'openemr':1A,19A,21B,26B,63C 'patient':5A,38B,55B,86C,98C 'payload':83C,91C 'place':82C 'prescript':57B,100C 'printabl':60B,103C 'run':8A,44B,106C 'save':33B 'script':9A,35B,43B,72C,80C,107C 'self':24B 'self-host':23B 'session':111C 'site':71C 'store':2A,68C 'user':12A,32B,51B,77C,95C 'version':61B,104C 'via':101C 'view':59B,102C 'vulner':73C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR installation before 8.5.0 where logged-in users can edit patient External ID values and other users view prescriptions through the printable HTML view. Sources do not say whether managed or hosted deployments are exposed by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","medium","openemr","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126450':15A,18A '-2026':14A,17A 'cve':13A,16A 'extern':6A 'id':7A 'openemr':1A,19A 'patient':5A 'run':8A 'script':9A 'store':2A 'user':12A 'xss':3A","search_b":"'8.5.0':28B 'authent':31B 'browser':47B 'extern':39B 'field':41B 'healthcar':20B 'host':25B 'html':62B 'id':40B 'let':29B 'open':53B 'openemr':21B,26B 'patient':38B,55B 'prescript':57B 'printabl':60B 'run':44B 'save':33B 'script':35B,43B 'self':24B 'self-host':23B 'user':32B,51B 'version':61B 'view':59B","search_c":"'8.5.0':65C 'allow':75C 'authent':76C 'browser':110C 'contain':66C 'cross':70C 'cross-sit':69C 'execut':92C 'extern':87C 'field':89C 'html':105C 'id':88C 'inject':79C 'open':96C 'openemr':63C 'patient':86C,98C 'payload':83C,91C 'place':82C 'prescript':100C 'printabl':103C 'run':106C 'script':72C,80C,107C 'session':111C 'site':71C 'store':68C 'user':77C,95C 'version':104C 'via':101C 'view':102C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:26:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126450","severity":null,"published_at":"2026-11-13T10:17:52+00:00","modified_at":"2026-11-13T10:17:52+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","fetched_at":"2026-11-13T10:47:23+00:00","note":null}],"documents":[{"id":145144,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-w2f7-289j-92pp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:26:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145145,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-patient-external-id-in-prescriptions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}