Cross-site scripting in OpenEMR - CVE-2026-126450
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164464
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-126450
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in other users' browsers and potentially disclose sensitive information.
The vulnerability exists due to improper neutralization of script-related HTML in OpenEMR's printable prescription view when rendering a patient's stored External ID. A remote user can store a malicious script in the External ID field during patient creation to execute it when another user views the patient's prescriptions using View Printable Version (HTML).
Affected software
OpenEMR
How to mitigate CVE-2026-126450
Install security update from vendor's website.
OpenEMR - update to 8.5.0