CVE-2026-62293
Received Received - Intake

Stored XSS in HAPI FHIR Scanner HTML Report

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-62293
EUVD
EUVD-2026-54614

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hapifhir org.hl7.fhir.core to 6.9.11 (exc)
hapifhir org.hl7.fhir.validation to 6.9.10 (inc)
hapi_fhir hapi_fhir to 6.9.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in HAPI FHIR versions before 6.9.11. The hidden scan command in Scanner.java concatenates attacker-controlled titles and references into scan.html without proper HTML escaping. When a user opens or publishes the generated HTML report, malicious JavaScript embedded in these titles executes in the report's browser context.

Detection Guidance

Check if your HAPI FHIR version is below 6.9.11 by inspecting the library version in your project dependencies. Look for scan.html files generated by the scan command and review their content for suspicious script tags or unescaped HTML in titles and references.

Impact Analysis

If you scan an attacker-supplied Implementation Guide or profile and then open the generated scan.html report, the attacker's JavaScript could execute in your browser. This might allow theft of session cookies, redirection to malicious sites, or other client-side attacks within the report's context.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data if exploited, potentially violating GDPR (data protection) or HIPAA (healthcare privacy) requirements. Organizations using affected versions may face compliance risks due to potential data exposure from XSS attacks.

Mitigation Strategies

Upgrade HAPI FHIR to version 6.9.11 or later immediately. Avoid scanning untrusted Implementation Guides or profiles until patched. Review and sanitize any existing scan.html reports for malicious content before opening.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart