What is the CVSS score of CVE-2026-33348?

CVE-2026-33348 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-33348?

A stored cross-site scripting vulnerability in OpenEMR allows authenticated users to inject malicious code into patient encounter records, potentially compromising other users' sessions and enabling…

How to fix or mitigate CVE-2026-33348?

Within 24 hours: Inventory all OpenEMR instances and confirm versions; disable or restrict access to the Eye Exam form functionality if possible; alert users not to click suspicious links from encounter notifications. Within 7 days: Implement compensating controls (WAF rules, role-based access restrictions, input validation strengthening); conduct audit logs for suspicious Eye Exam form submissions; review staff access levels to the 'Notes - my encounters' role. Within 30 days: Monitor vendor for patch release; establish incident response procedures for XSS exploitation; consider upgrading to OpenEMR 8.0.0.3 or later once available; conduct security awareness training on form injection risks.

Openemr CVE-2026-33348

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 GitHub_M

XSS Openemr

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 22:47 vuln.today

CVE Published

Mar 25, 2026 - 22:30 nvd

HIGH 8.7

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in OpenEMR's Eye Exam form functionality that allows authenticated users with the 'Notes - my encounters' role to inject malicious JavaScript payloads through form answers. OpenEMR versions prior to 8.0.0.3 are affected. Attackers can execute arbitrary JavaScript in the browsers of other authenticated users when they view the compromised encounter pages or visit history, potentially leading to session hijacking, credential theft, or unauthorized actions within the EHR system.

Technical ContextAI

OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*) is an open-source electronic health records and medical practice management application widely deployed in healthcare settings. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The flaw exists in the function responsible for displaying Eye Exam form answers within patient encounter pages. The application fails to properly sanitize or encode user-supplied input from form fields before rendering it in HTML contexts, allowing JavaScript injection. Because the payload is stored in the database and executed when retrieved, this represents a persistent XSS attack surface affecting all users with sufficient privileges to view the contaminated data.

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later, which contains a patch addressing this stored XSS vulnerability (see commit at https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2 and advisory at https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h). Organizations unable to immediately upgrade should implement compensating controls including restricting assignment of the 'Notes - my encounters' role to only highly trusted users, implementing Content Security Policy (CSP) headers to limit JavaScript execution, and conducting audits of existing Eye Exam form entries for suspicious content. Deploy Web Application Firewall (WAF) rules to detect common XSS patterns in form submissions as a temporary defensive layer.