CVE-2026-126456: OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and whose sessions are at risk?
An attacker needs clinician-level access to save a malicious value in the Fee Sheet notecodes field. The stored payload can execute when viewed by higher-privileged users, exposing those users' browser sessions to cross-site scripting.
Is user interaction required for exploitation?
Yes. A higher-privileged user must load or view content containing the attacker-controlled stored payload for the script to execute in that user's browser.
What versions should be remediated?
OpenEMR versions before 8.5.0 are affected. Upgrade to 8.5.0 or later.