Ca Uhn Hapi Fhir
Monthly
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.