Stored Cross-Site Scripting in HAPI FHIR Implementation by HAPI

CVE-2026-62293

What is CVE-2026-62293?

HAPI FHIR is a comprehensive implementation of the HL7 FHIR standard for healthcare interoperability in Java. In versions prior to 6.9.11, a vulnerability exists where the hidden scan command improperly concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into a scan.html file generated by Scanner.java. This inadequately sanitized input can lead to stored cross-site scripting. When a user scans a maliciously crafted IG/profile and subsequently views or publishes the generated local/CI HTML report, it may execute JavaScript injected by the attacker within the browser context. The vulnerability has been addressed in version 6.9.11.

References