CVE-2026-126493 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 accepts a crafted tableArgs value in the onsiteportalactivity API that is stored and later rendered unescaped on the audit review page. A low-privileged patient portal user can inject JavaScript that runs in a provider's browser when they click the delete button.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 with the patient portal enabled are exposed, because low-privileged patient portal users can store the payload. Providers who review the audit page in the admin interface are the victims. Installations without the patient portal, or already on 8.5.0 or later, are not affected.
Not affected if openemr-8.5.0-or-later, patient-portal-disabled
Who cares healthcare, openemr, self-hosted
8.5.0 or later.OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.