{"id":"CVE-2026-126476","kind":"vulnerability","aliases":["CVE-2026-126476"],"related":[],"title":"OpenEMR: reflected XSS in auto-suggest lets attackers run scripts","description":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.","summary":"OpenEMR before 8.5.0 echoes the searchMode POST parameter unencoded into an onClick attribute in the Application module's auto-suggest endpoint. An attacker who tricks a logged-in user into submitting a crafted search can run JavaScript in that user's session to steal session cookies or view patient data.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-authenticated-users","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review web server logs for POST requests to `application/index/search` containing single-quote characters in `searchMode`.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:56:27+00:00","updated_at":"2026-11-13T10:56:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:56:27Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"internet","title":"OpenEMR: reflected XSS in auto-suggest lets attackers run scripts","impact":"medium","summary":"OpenEMR before 8.5.0 echoes the searchMode POST parameter unencoded into an onClick attribute in the Application module's auto-suggest endpoint. An attacker who tricks a logged-in user into submitting a crafted search can run JavaScript in that user's session to steal session cookies or view patient data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts in a staff session, stealing cookies and patient data","analyst_note":"","how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review web server logs for POST requests to `application/index/search` containing single-quote characters in `searchMode`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-authenticated-users"],"who_is_affected":"Clinics and organisations running self-hosted OpenEMR older than 8.5.0 where staff are logged in and can be lured to a malicious link or page. Exposure depends on the Application module's auto-suggest endpoint being reachable by authenticated users. Instances already on 8.5.0 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4637,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126476':14A,17A '-2026':13A,16A '8.5.0':26B,78C 'applic':39B,89C 'application/index/search':124C 'arbitrari':126C 'attack':9A,47B,110C 'attribut':36B,109C 'authent':114C 'auto':6A,43B,93C 'auto-suggest':5A,42B,92C 'contain':79C 'cooki':71B,136C 'craft':58B 'cross':83C 'cross-sit':82C 'cve':12A,15A 'data':75B,140C 'disclos':138C 'echo':27B,97C 'endpoint':45B,95C 'execut':125C 'healthcar':18B 'host':23B 'induc':112C 'javascript':62B,127C 'let':8A 'log':52B 'logged-in':51B 'modul':40B,90C 'onclick':35B,108C 'openemr':1A,19B,24B,76C 'paramet':31B,101C 'patient':74B,139C 'payload':122C 'post':30B,100C 'quot':107C,121C 'reflect':2A,81C 'run':10A,61B 'script':11A,85C 'search':59B 'searchmod':29B,99C 'self':22B 'self-host':21B 'session':67B,70B,132C,135C 'singl':106C,120C 'single-quot':105C,119C 'site':84C 'steal':69B,134C 'submit':56B,117C 'suggest':7A,44B,94C 'trick':49B 'unencod':32B,102C 'user':54B,65B,115C,130C 'view':73B 'vulner':86C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Clinics and organisations running self-hosted OpenEMR older than 8.5.0 where staff are logged in and can be lured to a malicious link or page. Exposure depends on the Application module's auto-suggest endpoint being reachable by authenticated users. Instances already on 8.5.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126476':14A,17A '-2026':13A,16A 'attack':9A 'auto':6A 'auto-suggest':5A 'cve':12A,15A 'let':8A 'openemr':1A 'reflect':2A 'run':10A 'script':11A 'suggest':7A 'xss':3A","search_b":"'8.5.0':26B 'applic':39B 'attack':47B 'attribut':36B 'auto':43B 'auto-suggest':42B 'cooki':71B 'craft':58B 'data':75B 'echo':27B 'endpoint':45B 'healthcar':18B 'host':23B 'javascript':62B 'log':52B 'logged-in':51B 'modul':40B 'onclick':35B 'openemr':19B,24B 'paramet':31B 'patient':74B 'post':30B 'run':61B 'search':59B 'searchmod':29B 'self':22B 'self-host':21B 'session':67B,70B 'steal':69B 'submit':56B 'suggest':44B 'trick':49B 'unencod':32B 'user':54B,65B 'view':73B","search_c":"'8.5.0':78C 'applic':89C 'application/index/search':124C 'arbitrari':126C 'attack':110C 'attribut':109C 'authent':114C 'auto':93C 'auto-suggest':92C 'contain':79C 'cooki':136C 'cross':83C 'cross-sit':82C 'data':140C 'disclos':138C 'echo':97C 'endpoint':95C 'execut':125C 'induc':112C 'javascript':127C 'modul':90C 'onclick':108C 'openemr':76C 'paramet':101C 'patient':139C 'payload':122C 'post':100C 'quot':107C,121C 'reflect':81C 'script':85C 'searchmod':99C 'session':132C,135C 'singl':106C,120C 'single-quot':105C,119C 'site':84C 'steal':134C 'submit':117C 'suggest':94C 'unencod':102C 'user':115C,130C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:24:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126476","severity":null,"published_at":"2026-11-13T10:17:57+00:00","modified_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145195,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:24:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145196,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}