CVE-2026-33346: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33346 is a stored cross-site scripting (XSS) vulnerability in OpenEMR's patient portal payment flow, classified as High severity. It affects all OpenEMR versions up to and including 8.0.0.1, and was disclosed on March 19, 2026 by researchers pavelkohout396, stanislavfortaisle, and simecek via GitHub Security Advisory GHSA-qvf6-6xc6-9qv7. The vulnerability allows an authenticated patient portal user to inject persistent JavaScript that executes in the browser of any staff member who reviews the payment submission. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an output encoding omission. The $_POST['inv_values'] parameter submitted to portal/lib/paylib.php (line 155) is stored verbatim in the onsite_portal_activity.table_args database column via SaveAudit() — parameterized SQL prevents SQL injection, but no output encoding is applied to the stored value. When a staff member opens portal/portal_payment.php, the stored value is echoed directly into an inline <script> tag inside a single-quoted JavaScript string literal at line 94 (echo "<script>var jsondata='" . $edata['table_args'] . "';"), allowing a single quote in the payload to break out of the string context and execute arbitrary JavaScript. Notably, the same file correctly applies js_escape() for other values (lines 349–360), making this an oversight rather than a systemic flaw (GitHub Advisory, Patch Commit).

A low-privilege patient portal user can execute arbitrary JavaScript in the authenticated browser session of any staff member who reviews their payment submission. This enables session hijacking (theft of staff session tokens), unauthorized access to other patients' data visible in the staff UI, and actions performed on behalf of the staff user — including potential modification of medical records. No special configuration or non-default settings are required, as the patient portal and payment review are standard OpenEMR features (GitHub Advisory).

A proof-of-concept exploit with a concrete three-step reproduction sequence is publicly available in the GitHub Security Advisory, including a specific HTTP POST payload targeting portal/lib/paylib.php. The PoC demonstrates the full attack chain without requiring additional research to reproduce. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.032% (GitHub Advisory).

1. Authenticate to the patient portal: Log in to the OpenEMR patient portal using any valid patient account credentials.
2. Craft a malicious POST request: Bypass client-side validation by directly sending a POST request to portal/lib/paylib.php with a payload in the inv_values parameter:

   POST /portal/lib/paylib.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   Cookie: <session_cookie>
   
   mode=portal-save&form_pid=&inv_values=';alert(document.domain);//

3. Payload stored in database: The value ';alert(document.domain);// is stored verbatim in the onsite_portal_activity.table_args column via SaveAudit().
4. Wait for staff interaction: When a staff member opens the portal activity queue and clicks to review the patient's payment, portal/portal_payment.php renders the stored value unsanitized into a <script> block:

   <script>var jsondata='';alert(document.domain);//';var ccdata='...'</script>

5. JavaScript executes in staff session: The single quote closes the jsondata string, alert(document.domain) (or any attacker-chosen payload) executes as a standalone statement in the staff member's authenticated browser session, enabling session token theft, data exfiltration, or unauthorized actions (GitHub Advisory).

• Network: Unexpected or anomalous POST requests to /portal/lib/paylib.php containing JavaScript syntax characters (e.g., single quotes, alert, document.cookie, fetch) in the inv_values parameter body.
• Logs: Web server access logs showing POST requests to portal/lib/paylib.php with URL-encoded payloads containing %27 (single quote), %3B (semicolon), or JavaScript keywords; unusual outbound HTTP requests from staff browsers to attacker-controlled domains after accessing portal/portal_payment.php.
• Database: Entries in the onsite_portal_activity table where the table_args column contains JavaScript syntax (e.g., single quotes, <script>, alert(, document.cookie) rather than expected JSON-formatted payment data.
• Browser/Session: Unexpected session token reuse from unfamiliar IP addresses following staff access to the payment review page; staff accounts performing actions inconsistent with their normal behavior (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which fixes the issue by replacing raw string concatenation with js_escape() (wrapping both $edata['table_args'] and $edata['checksum']) in portal/portal_payment.php (Patch Commit). Until patching is possible, consider disabling the patient portal payment feature or restricting staff access to the payment review page. Additionally, implementing a Content Security Policy (CSP) header can reduce the impact of XSS exploitation as a defense-in-depth measure (GitHub Advisory).

The vulnerability was covered by The Hacker Wire shortly after disclosure and noted on social platforms including Mastodon and Bluesky. Aisle, the security firm whose researchers (stanislavfortaisle, simecek) co-discovered the vulnerability, published a broader blog post highlighting 38 critical security vulnerabilities found in healthcare software used by 100,000 providers, of which this CVE was one (The Hacker Wire). Community reaction focused on the sensitivity of the target — an EHR system handling protected health information — amplifying concern about the potential for patient data exposure via staff session hijacking.