VulnerabilityAnalyzed

CVE-2026-21443

If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS.

LOW 1.2EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), there are places in the codebase where `xl()` output is used directly without escaping. If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS. Version 8.0.0 fixes the issue.

CVSS 4.0: 1.2 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-116
Affected: open-emr/openemr
Source: security-advisories@github.com

References

https://github.com/openemr/openemr/commit/b1e3fe8a9ed8bcaf17e0b73d7fad5434f9fe36daPatch
https://github.com/openemr/openemr/security/advisories/GHSA-3f9j-cqjj-7h46Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.