Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NSummary
CVE-2026-33348 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Open-Emr Openemr. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33348 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting OpenEMR, a free and open-source electronic health records and medical practice management application. The flaw resides in the function responsible for displaying answers from Eye Exam forms within patient encounters. Users with the "Notes - my encounters" role can submit form answers that are then shown on the encounter page and in visit history for others with the same role. Versions of OpenEMR prior to 8.0.0.3 fail to properly sanitize these inputs, enabling the injection of arbitrary JavaScript payloads. The vulnerability carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impacts due to its cross-origin scope change.
An authenticated attacker possessing the "Notes - my encounters" role can exploit this by entering malicious JavaScript into Eye Exam form fields during a patient encounter. When any other user with the same role views the affected encounter page or visit history, the injected code executes in their browser context. This allows the attacker to steal session cookies, manipulate page content, perform actions on behalf of the victim, or exfiltrate sensitive patient data visible to that role, all over the network with low complexity but requiring user interaction to trigger.
Mitigation is available via the official patch in OpenEMR version 8.0.0.3, as detailed in the project's GitHub security advisory (GHSA-6ch2-p26g-x33h), release notes, and the fixing commit (f488efbe3eb7f17d0f057f960020cb611149f8a2). Security practitioners should prioritize upgrading affected instances, validate input sanitization in custom forms, and enforce principle of least privilege for the "Notes - my encounters" role to limit exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16012
Vulnerability Data
OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the…
more
encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Secure-coding standards, SAST scans and removal of insecure code samples together eliminate the failure to neutralize script content that produces cross-site scripting flaws.
Webpage malware scanning and block-listing of known malicious sites reduce the likelihood that reflected or stored script payloads reach a user’s browser.