CVE-2026-126475: OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments running versions before 8.5.0 are affected. Exploitation requires an authenticated attacker and user interaction, and the impact includes exposure of non-HttpOnly session cookies and patient data.
What must an attacker do to exploit the vulnerability?
The attacker must submit a crafted payload in the searchEleNo POST parameter to the application/index/search endpoint. The payload escapes an unencoded HTML attribute in the auto-suggest response and injects an event handler that executes when inserted into the DOM.
How can I remediate the issue?
Upgrade OpenEMR to version 8.5.0 or later. The provided information does not identify a workaround for deployments that cannot immediately upgrade.