What is the CVSS score of CVE-2026-26462?

CVE-2026-26462 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Offline Hospital Management System are affected by CVE-2026-26462?

Offline Hospital Management System 5.3.0 contains a remote code execution vulnerability enabling unauthenticated attackers to execute arbitrary system commands, directly threatening operational…

How to fix or mitigate CVE-2026-26462?

24 HOURS: Conduct inventory of systems running OHMS 5.3.0; restrict network access and isolate non-critical deployments; apply all available Electron framework security patches. 7 DAYS: Implement network segmentation limiting system accessibility; disable Node.js integration in Electron renderer configuration where operationally feasible; enable context isolation. 30 DAYS: Establish vendor patch monitoring; develop migration plan to unaffected versions; deploy endpoint detection capabilities for anomalous process execution.

Offline Hospital Management System CVE-2026-26462

EUVD-2026-30773 HIGH

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-05-18 mitre

GHSA-53vh-ccq9-xwq5

Node.js RCE

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 14:22 vuln.today

CVSS changed

May 19, 2026 - 14:22 NVD

7.3 (HIGH)

CVE Published

May 18, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.

AnalysisAI

Remote code execution in Offline Hospital Management System 5.3.0 stems from an insecure Electron renderer configuration where Node.js integration is enabled while context isolation is disabled, allowing JavaScript in the renderer to invoke Node.js APIs and run arbitrary OS commands. The flaw carries a CVSS 7.3 with network attack vector and no privileges required, though EPSS is low at 0.06% and no public exploit identified at time of analysis beyond a Medium write-up describing the technique.

Technical ContextAI

The affected software is a SourceForge-distributed Electron desktop application for hospital management. Electron applications run a Chromium-based renderer process that, by default in modern releases, should isolate web content from Node.js to follow the principle of least privilege. In this build the BrowserWindow is configured with nodeIntegration:true and contextIsolation:false, which exposes the full Node.js require() surface (including the child_process module) directly to any JavaScript executing in the renderer. This is the root cause class typically tracked as CWE-1188 (Insecure Default Initialization of Resource) or CWE-94 (Improper Control of Generation of Code). The CPE entry is generic (cpe:2.3:a:n/a:n/a:*) reflecting that MITRE has not yet assigned a vendor/product CPE for this SourceForge project.

RemediationAI

No vendor-released patch identified at time of analysis; the SourceForge project page is the canonical distribution point and no fixed release is referenced in the advisory data. Compensating controls focus on the Electron security model: rebuild the application setting contextIsolation:true and nodeIntegration:false in every BrowserWindow webPreferences, expose only narrow, audited APIs via a contextBridge preload script, and enable sandbox:true where feasible (side effect: any existing renderer code that calls require() directly must be refactored to use the preload bridge). As deployment-side mitigations until a fixed build is released, restrict the application to trusted local data only, avoid pasting or rendering untrusted external content within the app, block the application from loading remote HTTP(S) resources via host firewall or HOSTS file, and consider running it inside a least-privilege OS user account or sandbox to bound post-exploit impact. Track the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-26462 and VulDB entry https://vuldb.com/vuln/364476 for an official fix.