CVE-2026-33933 - Vulnerability Analysis

Overview

OpenEMR >= 7.0.2.1 and < 8.0.0.3 contains a reflected XSS caused by improper sanitization in the custom template editor, letting unauthenticated attackers execute arbitrary JavaScript in staff browsers via crafted URLs.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in authenticated staff browsers, potentially stealing session data or performing actions on their behalf.

Mitigation

Upgrade to version 8.0.0.3 or later.

References

• https://github.com/openemr/openemr/releases/tag/v8_0_0_3
• https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3
• https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200
• https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner