Stored XSS Vulnerability in OpenEMR Affects Patient Encounter Forms

CVE-2026-33348

What is CVE-2026-33348?

OpenEMR, an open-source electronic health records and medical practice management application, is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises due to improper handling of form inputs in the Notes - my encounters role, specifically when users fill out Eye Exam forms. Attackers with this role can input malicious JavaScript code into the responses, which is subsequently displayed on the encounter pages and visit history for all users with the same role. This vulnerability is patched in version 8.0.0.3, which addresses the insecure functionality allowing arbitrary code execution when displaying form results.

References