CVE-2026-32119

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician's browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue.

• CWE-79

• https://github.com/openemr/openemr/commit/70a41122c6d75ebcd219ba2a2535e93a6c188151Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hpExploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hpExploit, Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7
• CVE-2026-32113Discourse is an open-source discussion platform. From versio…6.1
• CVE-2026-32114Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-32116Magic Wormhole makes it possible to get arbitrary-sized file…8.1
• CVE-2026-32117The grafanacubism-panel plugin allows use of cubism.js in Gr…5.4
• CVE-2026-32118OpenEMR is a free and open source electronic health records …9
• CVE-2026-3212Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-32120OpenEMR is a free and open source electronic health records …6.3
• CVE-2026-32121OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-32122OpenEMR is a free and open source electronic health records …4.3
• CVE-2026-32123OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-32124OpenEMR is a free and open source electronic health records …5.4