OpenEMR allows inconsistent escaping of translation function output. The xl() function returns raw strings from the translation database. While wrapper functions exist for escaping in specific contexts, certain code paths use xl() directly, leading to potential cross-site scripting if an attacker can insert malicious content into the translations. The vulnerability would allow execution of arbitrary client-side scripts when a victim views translated content.

Affects the openemr openemr application prior to version 8.0.0. The issue was fixed in release 8.0.0, so any installation running an older major version is vulnerable. The vulnerability applies to all deployments that use the default translation mechanisms.

The CVSS score of 1.2 classifies the vulnerability as low. EPSS indicates a probability of less than 1 %, and it is not listed in the CISA KEV catalog, suggesting that exploitation is currently rare. However, the attack would require an attacker to be able to insert or modify translation entries, which might be achievable through an administrative interface or compromised database access. If that capability exists, the exploitation path would involve an attacker adding malicious markup to a translation entry, which then gets rendered unescaped in the web interface, causing script execution in the victim’s browser.