CVE-2026-32119 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.2 contains a DOM-based stored XSS caused by improper handling in the jQuery SearchHighlight plugin, letting authenticated users with encounter form write access execute arbitrary JavaScript in other clinicians' browsers, exploit requires write access to encounter forms.

Severity & Score

Impact

Authenticated users can execute arbitrary JavaScript in other clinicians' browsers, potentially leading to session hijacking or data theft.

Mitigation

Update to version 8.0.0.2 or later.

References

• https://github.com/openemr/openemr/commit/70a41122c6d75ebcd219ba2a2535e93a6c188151
• https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner