Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-07T20:16:52.157Z",
  "pubdate": "2026-08-07T20:16:52.157Z",
  "executiveSummary": "An unvalidated input vulnerability exists in HAPI FHIR prior to version 6.9.11, specifically involving the hidden scan command within Scanner.java.\nThe flaw allows an attacker to supply malicious Implementation Guide titles, profile titles, and source references containing arbitrary JavaScript payloads.\nWhen a user executes a scan on the attacker-supplied data, these input strings are concatenated directly into the resulting scan.html report without proper sanitization or context-aware output encoding.\nSubsequent opening or publishing of the generated local or Continuous Integration (CI) HTML report triggers a Stored Cross-Site Scripting (XSS) condition.\nThis executes the attacker-controlled JavaScript within the browser context of the victim viewing the report.\nThe risk implication is significant as it compromises the integrity and confidentiality of the affected user session, potentially allowing unauthorized actions or data access within the browser environment.\nExploitation requires the user to process an attacker-supplied IG or profile and subsequently view the generated HTML report.",
  "technicalDetails": "The vulnerability resides in Scanner.java within HAPI FHIR, affecting all versions prior to 6.9.11.\nThe root cause is the insecure direct concatenation of untrusted input parameters—specifically Implementation Guide titles, profile titles, and source references—into the generation of the scan.html report.\nBecause the application fails to perform input sanitization or output encoding on these fields before writing them to the HTML document, the generated output interprets malicious strings as executable markup.\nThe attack flow begins when an attacker crafts a malicious Implementation Guide, profile, or source reference containing payloads such as `<script>` tags or event handlers embedded in the title or reference attributes.\nA victim user initiates a scan on this attacker-supplied artifact using the hidden scan command.\nScanner.java processes the input and writes the unescaped data directly into the scan.html file.\nThe attack culminates when the victim or an automated CI process opens the generated local or CI HTML report in a web browser.\nThe browser parses the malicious HTML, executing the injected JavaScript payload within the context of the report's origin.\nThis enables arbitrary script execution in the victim's browser context, potentially leading to session hijacking, disclosure of sensitive local data, or manipulation of the rendered report interface.\nAuthentication and privilege requirements depend on the execution context of the scan command and report viewing environment, but network exposure is localized to the systems processing and viewing the generated HTML reports."
}