CVE-2026-32125: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-32125 is a stored cross-site scripting (XSS) vulnerability in OpenEMR's Track Anything feature, affecting all versions prior to 8.0.0.1. Track and item names submitted via user input are stored without sanitization and later rendered in Dygraph chart titles/labels using innerHTML, allowing injected scripts to execute in any viewer's browser. The vulnerability was published on March 11, 2026, and patched in version 8.0.0.1. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The backend library library/ajax/graph_track_anything.php returns user-controlled track and item names in JSON; the front-end script interface/forms/track_anything/report.js passes returnData.title directly to the Dygraph charting library, which sets the chart title via innerHTML (lines 8050 and 8091 of dygraph.js). Because Dygraph explicitly supports arbitrary HTML in title values, any HTML or JavaScript stored in a track/item name is executed verbatim in the browser of any user who views the corresponding graph. Exploitation requires an authenticated user with permission to create or edit Track Anything items, and a separate victim user who views the graph (user interaction required) (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other OpenEMR users — including clinicians and administrators — who view the affected Track Anything graph. This enables session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential modification of displayed medical data. The impact scales with the privilege level of the victim user; a compromised administrator session could lead to broader system access (GitHub Advisory).

A proof-of-concept (PoC) with step-by-step reproduction instructions and specific payload examples (e.g., <script>alert(document.cookie)</script>) is publicly available in the GitHub Security Advisory (GitHub Advisory). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.174%, indicating low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authenticate: Log in to an OpenEMR instance (version < 8.0.0.1) as any user with permission to create or edit Track Anything tracks or items.
2. Inject payload: Navigate to the Track Anything feature and create or edit a track or item, setting the name field to a malicious payload such as <script>alert(document.cookie)</script> or an attribute-breaking variant like " onmouseover="alert(1) if the name is used in an HTML attribute context.
3. Store the payload: Submit the form; the malicious name is stored server-side without sanitization via a POST request handled by library/ajax/graph_track_anything.php.
4. Trigger execution: When any user (the attacker or a victim) navigates to the Track Anything graph view for the affected track/item, the front-end script interface/forms/track_anything/report.js passes the stored name to Dygraph, which renders it via innerHTML, executing the injected script in the viewer's browser.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions as the victim user, or modify page content — with impact proportional to the victim's privilege level (GitHub Advisory).

• Logs: OpenEMR access logs showing POST requests to Track Anything creation/edit endpoints containing HTML tags or JavaScript keywords (e.g., <script>, onerror=, onmouseover=) in track or item name parameters.
• Logs: Access log entries showing multiple users loading the Track Anything graph view (interface/forms/track_anything/report.js or related graph endpoints) shortly after a suspicious track/item was created.
• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from OpenEMR graph pages.
• File System / Database: Track or item name fields in the OpenEMR database containing raw HTML or JavaScript strings (e.g., <script>, alert(, document.cookie) rather than plain text.

The fix is available in OpenEMR version 8.0.0.1; administrators should upgrade immediately. The remediation involves escaping or sanitizing track/item names at the point of output — using textContent instead of innerHTML, or applying a strict HTML sanitization library before passing values to Dygraph. As a temporary workaround, restrict the ability to create or edit Track Anything items to only highly trusted users until patching is complete, and consider deploying a Content Security Policy (CSP) header to limit inline script execution (GitHub Advisory).

The vulnerability was reported by researcher pavelkohout396 and analyzed by simecek, with the advisory published by kojiromike on the OpenEMR GitHub repository. A security blog post covering the vulnerability was published at infinitsec.net shortly after disclosure. Aisle security researchers also referenced this CVE as part of a broader disclosure of 38 security vulnerabilities found in healthcare software used by 100,000+ providers (GitHub Advisory).