This vulnerability allows a malicious code description to be stored in the database and rendered by the dynamic code picker endpoint without HTML escaping. An attacker who can create or edit a code—typically an administrator or a user with code‑management rights—can inject arbitrary JavaScript. When any user opens the picker, the script executes in their browser, enabling phishing attacks, credential theft, or session hijacking.

OpenEMR versions earlier than 8.0.0.1 are affected. The issue arises in the AJAX endpoint that returns code_text for code pickers used in many parts of the application. The fix was implemented in OpenEMR 8.0.0.1.

The CVSS score is 5.4, indicating moderate severity. EPSS is under 1 %, suggesting exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the code‑management interface; unauthenticated users cannot inject payloads. Therefore the threat is confined to environments where privileged users are compromised or maliciously enabled.