{"id":"CVE-2026-62293","title":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java","summary":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source re…","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-20","CWE-79"],"published":"2026-08-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62293","references":[{"url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be","label":"security-advisories@github.com"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw","label":"security-advisories@github.com"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00165,"epssPercentile":0.06133,"ingestedAt":"2026-09-09T21:22:45.524Z","slug":"CVE-2026-62293","body":"## Overview\n\nHAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}