CVE-2026-21443

LOW EPSS 3.9%
Published Feb 25, 20264mo ago · Modified Jun 17, 20262w ago
1.2 CVSS 4.0
Low
Find Similar
Published Feb 25, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), there are places in the codebase where `xl()` output is used directly without escaping. If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS. Version 8.0.0 fixes the issue.

CVSS Details

Base Score
1.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
3.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-116

Affected Products 1

VendorProductVersionRange
open-emropenemr* <8.0.0

References 2

  • github.com https://github.com/openemr/openemr/commit/b1e3fe8a9ed8bcaf17e0b73d7fad5434f9fe36da
    Patch
  • github.com https://github.com/openemr/openemr/security/advisories/GHSA-3f9j-cqjj-7h46
    MitigationVendor Advisory

Remediation

  • github.com https://github.com/openemr/openemr/commit/b1e3fe8a9ed8bcaf17e0b73d7fad5434f9fe36da
    Patch