OpenEMR is susceptible to a stored cross‑site scripting flaw in the CCDA document preview. The XSL stylesheet sanitizes most narrative elements but mistakenly leaves the linkHtml attribute unsanitized, allowing an attacker to embed a malicious href such as javascript:… or event handler attributes. When a clinician opens the preview, the attacker’s script runs in the user’s browser, granting client‑side code execution that can hijack the session, exfiltrate data, or perform other malicious actions. The weakness is classified as CWE‑79.

The flaw affects all OpenEMR installations whose version is earlier than 8.0.0.3. The issue was fixed in commit 95e6078 and rolled into the 8.0.0.3 release, so any release at or above that version is no longer vulnerable.

This vulnerability carries a CVSS score of 7.6, indicating high severity. However, the EPSS score is below 1 %, suggesting a low probability of exploitation at the moment, and it is not listed in the CISA KEV catalog. An attacker must be able to supply a CCDA document to the target system—either by uploading or by forwarding the file—and the victim must subsequently view the preview for the payload to execute. Because the attack vector is limited to client‑side actions, the risk to the system is largely confined to the compromised user’s session.