CVE-2026-33933

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33933", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T19:50:52.103Z", "datePublished": "2026-03-25T23:40:16.193Z", "dateUpdated": "2026-03-26T14:23:30.021Z"}, "containers": {"cna": {"title": "Reflected XSS via Unescaped contextName Parameter in Custom Template Editor", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3"}, {"name": "https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200"}, {"name": "https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8"}, {"name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": ">= 7.0.2.1, < 8.0.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:40:16.193Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue."}], "source": {"advisory": "GHSA-9qh7-cfq4-j7c3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T14:23:26.710975Z", "id": "CVE-2026-33933", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:23:30.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33933", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T14:23:26.710975Z"}}}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:23:22.033Z"}}], "cna": {"title": "Reflected XSS via Unescaped contextName Parameter in Custom Template Editor", "source": {"advisory": "GHSA-9qh7-cfq4-j7c3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": ">= 7.0.2.1, < 8.0.0.3"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200", "name": "https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8", "name": "https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:40:16.193Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33933", "state": "PUBLISHED", "dateUpdated": "2026-03-26T14:23:30.021Z", "dateReserved": "2026-03-24T19:50:52.103Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T23:40:16.193Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": ">= 7.0.2.1, < 8.0.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "37A001F6-4070-4BC4-8A5A-B4CCEA856E39", "versionEndExcluding": "8.0.0.3", "versionStartIncluding": "7.0.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto de registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. A partir de la versi\u00f3n 7.0.2.1 y antes de la versi\u00f3n 8.0.0.3, una vulnerabilidad de cross-site scripting (XSS) reflejado en el editor de plantillas personalizadas permite a un atacante ejecutar JavaScript arbitrario en la sesi\u00f3n del navegador de un miembro del personal autenticado envi\u00e1ndoles una URL manipulada. El atacante no necesita una cuenta de OpenEMR. La versi\u00f3n 8.0.0.3 corrige el problema."}], "id": "CVE-2026-33933", "lastModified": "2026-06-17T10:38:19.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33933", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T14:23:26.710975Z", "version": "2.0.3"}}]}, "published": "2026-03-26T00:16:40.120", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.2.1,8.0.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-26T17:37:02.358763+00:00", "value": {"mitigation_remediation": ["Apply the patch delivered in OpenEMR version 8.0.0.3 or later to eliminate the reflected XSS flaw.", "If an upgrade cannot be performed immediately, restrict access to the custom template editor functionality to trusted staff and consider implementing a web application firewall rule to block or sanitize the contextName parameter in incoming URLs."], "summary": {"action": "Immediate Patch", "impact": "Client\u2011Side Code Execution via Reflected XSS"}, "threat_synthesis": {"affected_systems": "OpenEMR, the open\u2011source electronic health records system, is affected. Vulnerable releases start with 7.0.2.1 and continue through versions up to but not including 8.0.0.3. The vulnerability was fixed in release 8.0.0.3, which should be applied by all users running earlier versions.", "description_and_impact": "The vulnerability is a reflected cross\u2011site scripting flaw in the custom template editor of OpenEMR. A crafted URL containing an unescaped contextName parameter can send arbitrary JavaScript to an authenticated staff member\u2019s browser. This flaw enables the execution of client\u2011side code, allowing an attacker to hijack the user\u2019s session, steal data, perform actions on behalf of the user, or modify content in the browser. The weakness is a classic reflected XSS, identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity flaw, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The attack vector involves an attacker sending a malicious URL to an authenticated staff member; no OpenEMR account is required to craft the exploit. Because the flaw only affects the client\u2019s browser and does not allow server\u2011side code execution or privilege escalation, the risk is contained to the compromised user. The absence of a listing in CISA\u2019s KEV catalog further indicates no known exploitations have been reported. Nonetheless, organizations should treat this as a medium\u2011to\u2011high risk due to the potential impact on patient data confidentiality and staff productivity."}}}}, "created": "2026-03-26T11:31:06.744551+00:00", "updated": "2026-03-27T09:29:18.860758+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}