This vulnerability arises from the client‑side use of jQuery's .html() method in the portal sign‑er modal of OpenEMR. Patient names are rendered by the application without proper sanitization and are then inserted into the DOM via .html(), allowing an attacker to inject arbitrary JavaScript. The injection can lead to the execution of script in the context of the portal, potentially stealing session cookies, defacing the interface, or redirecting users. The root cause is unsanitized patient names stored in patient_data, consistent with the CWE‑79 classification.

The flaw exists in all OpenEMR releases prior to version 8.0.0.1. The affected component is the portal sign‑er modal located at portal/sign/assets/signer_api.js. The product is openemr:openemr, any platform supported by this open source application. The specific vulnerable versions are all releases before 8.0.0.1.

The CVSS score of 7.7 reflects a high severity impact, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at the moment. However, the vulnerability can be exploited by an attacker who has the ability to create or modify a patient name, a capability generally available to users with access to the patient records. The attack vector is client‑side DOM, requiring the victim to view the portal sign‑er modal. The vulnerability is not listed in the CISA KEV catalog, implying no known exploits, but future exploitation is possible if a malicious script is injected into a patient’s record and viewed.