CVE-2026-32119 Details
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician's browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue.
A DOM-based stored cross-site scripting vulnerability has been identified in OpenEMR versions prior to 8.0.0.2. The issue resides within the jQuery SearchHighlight plugin, specifically in the file 'library/js/SearchHighlight.js'. This vulnerability allows an authenticated user with write access to encounter forms to inject arbitrary JavaScript. The injected script executes in the browser session of another clinician when they use the search feature on the Custom Report page. The vulnerability arises because the plugin improperly handles HTML entity encoding by reading decoded text from DOM text nodes, merging it into a raw HTML string, and then passing it to jQuery's '$()' constructor for HTML parsing.
Users can update to OpenEMR version 8.0.0.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/openemr/openemr/commit/70a41122c6d75ebcd219ba2a2535e93a6c188151 | [email protected] | Patch |
| https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.0.0.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | New CVE Received | [email protected] |