CVE-2026-126493: OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A low-privileged patient portal user can exploit it by submitting a crafted value in the tableArgs field of the onsiteportalactivity API. The attack requires that user to be able to store the payload.
What user interaction is required for the stored script to execute?
A provider must click the delete button on the audit review page where the malicious stored value is rendered. The payload uses spaces to break out of an unquoted data-delete-id attribute.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided data does not identify a workaround for installations that cannot upgrade immediately.