High priorityDisclosed

Advisory · CVE-2026-124448

OpenEMR clinical document previews can run scripts in a clinician's session

OpenEMR before 8.3.0 contains stored cross-site scripting in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML, letting authenticated users upload a crafted CCDA/CCD document that executes script in a clinician's session when previewed, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124448
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR previews clinical documents by turning them into web pages, and the converter copies some hidden instructions straight through. A crafted document can hide a script in those instructions, and it runs in the clinician's browser the moment they preview it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted document uploaded

    An authenticated user uploads a CCDA/CCD document carrying onmouseover, onclick, or onfocus handlers.

  2. 02Stylesheet copies handlers

    cda.xsl copies event-handler attributes past a character denylist, and ccd.xsl copies table-cell attributes unsanitized.

  3. 03Preview rendered

    A clinician previews the document.

  4. 04Script executes

    The handler runs in the clinician's session, acting with their privileges.

What happened

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can upload a crafted CCDA/CCD document with onmouseover, onclick, or onfocus handlers to execute script in a clinician’s session when previewed. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and passive user interaction.

Clinical documents arrive from outside the clinic, so the preview path is exposed to untrusted content by design. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review uploaded CCDA/CCD documents for event-handler attributes.
  4. Review clinician sessions for unexpected actions after document previews.
  5. Verify the deployed version after updating.

Management note

A script running as a clinician can read and change patient records. Treat previews of untrusted documents as a privileged action until patched.