The scanner component of HAPI FHIR concatenates titles, profile titles and source references supplied by an attacker into a generated scan.html file without applying any escaping. When a malicious Implementation Guide or profile is scanned, the resulting report contains unescaped JavaScript that can execute in any browser that opens or publishes the file. This stored cross‑site scripting can lead to theft of session tokens, credential leakage or unauthorized actions performed on behalf of the report viewer.

The flaw affects the HAPI FHIR implementation, specifically the org.hl7.fhir.validation module, its command‑line interface org.hl7.fhir.validation.cli and the core library org.hl7.fhir.core. All versions before 6.9.11 are vulnerable; the issue is resolved in 6.9.11 and later.

The CVSS base score of 5 indicates a moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted Implementation Guide or profile to a user who subsequently opens the scan report, typically in a local or CI environment. The attack is confined to the viewer’s browser, but the potential damage is limited to the context of that report reader.