---
id: "CVE-2026-126450"
page: "https://infrastack.ai/live/CVE-2026-126450"
kind: "vulnerability"
aliases: ["CVE-2026-126450"]
title: "OpenEMR: stored XSS in patient External ID runs script for other users"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OpenEMR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["version-8.5.0-or-later"]
published_at: "2026-11-13T10:17:52+00:00"
first_seen_at: "2026-11-13T10:47:23+00:00"
updated_at: "2026-11-13T10:57:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126450", "first_seen_at": "2026-11-13T10:47:23+00:00"}]
exploit_sources: []
---

# OpenEMR: stored XSS in patient External ID runs script for other users

Link for people: https://infrastack.ai/live/CVE-2026-126450 (this .md is for agents)

OpenEMR before 8.5.0 lets an authenticated user save a script in the patient External ID field. The script runs in the browser of any other user who opens that patient's prescriptions through View Printable Version (HTML).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenEMR affected range not listed fixed no fixed version listed

## How to check

- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.
- Review whether users can edit the patient External ID field and whether prescription printable views render it unescaped.

## Fix

- OpenEMR: move to `8.5.0` or later (fixed version per the NVD description).

## Timeline

- 2026-11-13T10:47:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126450

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-w2f7-289j-92pp
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-patient-external-id-in-prescriptions

## From the sources

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_