Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-05T20:17:38.190Z",
  "pubdate": "2026-11-05T20:17:38.190Z",
  "executiveSummary": "OpenEMR versions prior to 8.3.0 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input.\nThe vulnerability resides within specific clinical form modules where input data is improperly rendered within HTML attributes using text() with the ENT_NOQUOTES flag.\nAn authenticated attacker with clinical user privileges can inject malicious JavaScript payloads by escaping the context of double-quoted HTML attributes.\nWhen a victim clinician accesses a tainted record, the browser executes the injected script within the security context of the victim's session.\nThe impact includes the potential unauthorized access to sensitive session tokens, the exposure of Protected Health Information (PHI), and the execution of unauthorized patient-record actions on behalf of the victim.\nExploitation requires a successful authentication to the OpenEMR platform, specifically targeting the clinical interface to store the malicious payload.",
  "technicalDetails": "The vulnerability is a classic stored XSS flaw stemming from the insufficient sanitization of data rendered within the user interface of OpenEMR.\nSpecifically, the files interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php handle fields such as 'transfer_to', 'code', and 'codetext' using the text() function.\nThe core issue is the reliance on the ENT_NOQUOTES flag within the rendering logic. Because the input is injected into HTML value attributes enclosed in double quotes, the failure to escape double quote characters allows an attacker to break out of the intended attribute context.\nThe attack flow begins when an authenticated clinician saves a record containing a crafted payload. For example, an attacker can input a string such as '\" onmouseover=\"[malicious_script]\"' into one of the vulnerable fields. Because the input is not sanitized against quote characters, the resulting HTML rendered to the victim's browser includes the malicious event handler directly within the form element's attribute.\nWhen a subsequent user, such as another clinician, views the compromised record, the injected JavaScript is executed by the browser. Because the attacker's script runs within the authenticated session of the victim, it gains the same origin policy access to the document object model (DOM), cookies, and session data associated with the OpenEMR instance.\nThis permits the execution of unauthorized actions, such as modifying patient records, exfiltrating data, or performing administrative functions, all of which inherit the permissions of the targeted victim. The vulnerability is persistent; as long as the record containing the payload remains in the database, any user who views the form is susceptible to the attack.\nThe susceptibility is specific to versions prior to 8.3.0, and the attack requires active exploitation of clinical user privileges to inject the payload into the system's database storage."
}