OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), there are places in the codebase where `xl()` output is used directly without escaping. If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS. Version 8.0.0 fixes the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Wed, 25 Feb 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), there are places in the codebase where `xl()` output is used directly without escaping. If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS. Version 8.0.0 fixes the issue. | |
| Title | OpenEMR allows inconsistent escaping of translation function output | |
| Weaknesses | CWE-116 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-02-25T01:23:22.052Z
Updated: 2026-02-25T01:23:22.052Z
Reserved: 2025-12-29T03:00:29.276Z
Link: CVE-2026-21443
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-25T02:16:21.863
Modified: 2026-02-25T02:16:21.863
Link: CVE-2026-21443
Redhat
No data.