CVE-2026-32124
MEDIUMOpenEMR < 8.0.0.1 - Stored Cross-Site Scripting via Code Description in Dynamic Code Picker
Title source: llmDescription
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code picker AJAX endpoint returns code descriptions (code_text) that are rendered in the front end (e.g. DataTables) without HTML escaping. If an administrator (or user with code management rights) creates or edits a code with a malicious description containing script, that script runs in the browser of every user who uses the picker. This vulnerability is fixed in 8.0.0.1.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/openemr/openemr/security/advisories/GHSA-9hw7-22mr-qhfc
Scores
CVSS v3
5.4
EPSS
0.0005
EPSS Percentile
16.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
open-emr/openemr
< 8.0.0.1
Published
Mar 11, 2026
Tracked Since
Mar 12, 2026