CVE-2026-126450: OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
Which users are exposed to the stored script execution?
Authenticated users who open a patient's prescriptions using View Printable Version (HTML) may execute a script stored in that patient's External ID field. The script runs in the viewing user's browser session.
What access does an attacker need to exploit this issue?
The attacker needs authenticated access to OpenEMR and must be able to place a script payload in a patient's External ID field. No victim interaction beyond opening the affected printable prescription view is described.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. Version 8.5.0 is identified as the boundary after which this issue is not described as affected.