OpenEMR stores user supplied track names from the Track Anything feature without escaping them, and these names are later rendered in Dygraph charts using innerHTML or equivalent. This allows an attacker with the ability to create or edit items to inject script that runs in the browser of any user who views the corresponding graph. The vulnerability can lead to execution of arbitrary JavaScript, potentially enabling session hijacking, data theft or phishing. The weakness is categorized as CWE-79.

The issue exists in OpenEMR versions prior to 8.0.0.1. All installations running any release before that patch are affected; the fix is applied in OpenEMR 8.0.0.1 and later.

The CVSS base score is 5.4, indicating moderate severity. The EPSS score is below 1 %, suggesting low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have write access to Track Anything items and then a victim to view the graph, making it a stored XSS that can be triggered by any user who views the chart after the payload is stored. Given the moderate score and low exploit likelihood, the risk is considered moderate but should be mitigated promptly.