Stored XSS in OpenEMR Clinical Document Previews

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can upload a crafted CCDA/CCD document with onmouseover, onclick, or onfocus handlers to execute script in a clinician's session when previewed.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenEMR, a widely-deployed open-source electronic health record system, contains a stored cross-site scripting (XSS) vulnerability in its CCDA/CCD document preview functionality. The vulnerability exists because the cda.xsl and ccd.xsl stylesheets fail to properly sanitize event-handler attributes and table-cell attributes when rendering clinical documents for preview. Authenticated users—including those with limited privileges—can upload malicious CCDA/CCD files containing embedded JavaScript payloads (via onmouseover, onclick, or onfocus handlers) that execute with the privileges of any clinician who previews the document. This is particularly dangerous in healthcare environments where clinicians frequently review patient documents and may have elevated system access, potentially leading to unauthorized access to sensitive patient data, lateral movement within the EHR system, or manipulation of clinical records.

Casky's 323 matching skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Initial Access, including malicious file uploads) and TA0043 (Reconnaissance). Claude AI's extended reasoning capability identifies the attack chain: practitioners would see findings highlighting unsanitized XML/XSL attribute handling, detection of event-handler patterns in uploaded documents, and evidence of script execution contexts within authenticated sessions. The platform correlates input validation weaknesses with stored payload persistence, flagging the CCDA/CCD preview functionality as a high-risk attack surface. Security teams using Casky would receive specific alerts about files containing dangerous HTML attributes, the transformation pipeline's failure to sanitize XSLT outputs, and behavioral indicators of privilege escalation through document-triggered XSS—enabling them to patch OpenEMR before malicious documents reach clinicians.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124448.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-124448

Casky has 323 skills that investigate the attack patterns behind CVE-2026-124448. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn