EUVD-2026-54614Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:L because the scan tool runs locally and report is local; PR:N since attacker controls only the IG artifact, not the victim system; UI:R because victim must open the report; S:C for browser-context XSS scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.
AnalysisAI
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Technical ContextAI
HAPI FHIR (CPE: cpe:2.3:a:hapifhir:org.hl7.fhir.core:*:*:*:*:*:*:*:*) is the dominant open-source Java implementation of HL7 FHIR, widely deployed in healthcare interoperability pipelines. The vulnerable code path is in Scanner.java within the validation module. The genScanOutput and genScanOutputItem methods construct an HTML report (scan.html) by directly string-concatenating IG titles (ig.present()), profile titles (sd.present()), source references (s, sp, si), and the report title - all attacker-controllable via the contents of a supplied IG or profile - without applying any HTML escaping. CWE-20 (Improper Input Validation) identifies the root cause as failure to sanitize user-supplied data before embedding it in an HTML output context. The fix confirmed in commit 3a9befd applies Utilities.escapeXml() uniformly across all seven affected concatenation sites in Scanner.java, covering both attribute values (title= attributes) and element text content.
RemediationAI
Vendor-released patch: version 6.9.11. Upgrade org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.11 or later; the fix is confirmed in commit 3a9befd8845f003095ed75f4b24b9a80630275be (https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be). For teams that cannot upgrade immediately, the most effective compensating control is to restrict the scan command to IGs and profiles sourced exclusively from trusted, internally controlled registries - scanning third-party or community-supplied IGs should be blocked or quarantined until patched. Additionally, generated scan.html reports should not be published to shared web locations (intranet sites, GitHub Pages, CI artifact stores with broad access) until the patch is applied, since XSS only triggers in a browser; keeping reports in local filesystem paths with no web serving eliminates the exposure entirely. The advisory is at https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today