Loading vulnerability…
Stored XSS in OpenEMR Eye Exam form answers
CVE-2026-33348 is a stored cross-site scripting vulnerability in OpenEMR versions prior to 8.0.0.3. The flaw affects the functionality that displays answers submitted through Eye Exam forms in patient encounters. Users with the Notes - my encounters role can fill these forms, and the submitted answers are later rendered on the encounter page and in visit history views. Due to insufficient neutralization of untrusted input before it is displayed, an authenticated attacker with that role can store malicious JavaScript payloads in form answers. When another user with the same role views the affected encounter page or visit history, the injected script executes in that user's browser context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of arbitrary JavaScript in the browser of a user viewing the malicious Eye Exam form answers. This can enable session hijacking, unauthorized actions performed in the victim's session, access to sensitive patient or application data visible to the victim, and modification of application content or workflow within the victim's privileges. The CVSS vector provided in the source indicates scope change with high confidentiality and integrity impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the vulnerable Eye Exam form functionality and limit assignment of the Notes - my encounters role to only fully trusted users. Monitor Eye Exam form submissions and encounter history content for suspicious script payloads, and consider applying temporary output encoding or sanitization controls in the affected rendering path if operationally feasible. Because exploitation requires stored malicious content to be viewed, reducing exposure of the affected pages and reviewing existing stored form data may reduce risk until patching is completed.
Patch, then assume compromise.
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the vendor patch for this issue. The provided references indicate the fix is included in release v8_0_0_3 and associated with commit f488efbe3eb7f17d0f057f960020cb611149f8a2.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.