Improper Encoding or Escaping of Output in OpenEMR - CVE-2026-21443
Published: April 23, 2026
Vulnerability identifier: #VU127251
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-21443
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script code in a user's browser.
The vulnerability exists due to improper encoding or escaping of output in the xl() translation function output and related translation wrappers when rendering translation strings in HTML, XML, or JavaScript contexts without proper escaping. A remote user can insert malicious content into the translation database to execute arbitrary script code in a user's browser.
Exploitation requires the ability to modify translation table contents in the database.
Affected software
OpenEMR
How to mitigate CVE-2026-21443
Install security update from vendor's website.
OpenEMR - update to 8.0.0