{"id":"CVE-2026-62293","summary":"HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles","details":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.","aliases":["GHSA-6vcw-fq7v-4vhw"],"modified":"2026-08-09T08:05:11.179548Z","published":"2026-08-07T19:26:28.073Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62293.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62293.json"},{"type":"ADVISORY","url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62293"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hapifhir/org.hl7.fhir.core","events":[{"introduced":"0"},{"fixed":"3a9befd8845f003095ed75f4b24b9a80630275be"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.9.11"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.9.9","6.9.8","6.9.4","6.9.7","6.9.6","6.9.5","6.9.3","6.9.2","6.9.1","6.9.0","6.8.1","6.8.2","6.7.11"],"database_specific":{"vanir_signatures_modified":"2026-08-09T08:05:11Z","vanir_signatures":[{"target":{"file":"org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java","function":"genScanOutputItem"},"deprecated":false,"digest":{"function_hash":"201956488007298116012524515163085477043","length":1053},"id":"CVE-2026-62293-3081937c","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be"},{"signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be","target":{"file":"org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java"},"deprecated":false,"digest":{"line_hashes":["217102266532162766482535417964654494421","124367192151402571212902345556947991861","256885436404088917184072052681139179849","328090784224277570671800420960449431309","297937555198120023165902397313039137901","251949303453746747478245294808632785993","93273918145826939076985587561028803535","279101495366573329732892438032787444299","303610269898953222131853664834798061233","219428679336467930642289662831600898033","1052097579533551147474640179642489431","291151408804497497111295237494503161516","30751174690873817070390251906273395507","269266132067958412788219154319330565960","154011750327073936133780263806793650621","98425472773992871182152850816691483791","134944870862364977374341378060966648489","4342991279951097638062721478211182277","225006945780337526857698100174550333070","137368727723412902753922778459828525006","101811052740214065993239062391900989567","28379928519592878247541453126713246792","113941880013594723592129348577570764424","326669562432175983589727367903642460456","305972810684907346860078625055655075190","328008996145846071524551393315888996244","222755541355404738506126488450540120412","155399420299753465162085905144848057458","57522494929884894019751761931467729779","272972815075902194741445651173556312937","231132114474110757204161480854584757347","302582088717703127860130865571761093828","327947442433624969656234156274081327139","287398168183360755140496545431566848654"],"threshold":0.9},"id":"CVE-2026-62293-5a948449","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"163675745107125732271943428137337898709","length":4914},"id":"CVE-2026-62293-8653b066","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be","target":{"function":"genScanOutput","file":"org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62293.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}