CVE-2026-62293: HAPI FHIR XSS Vulnerability

CVE-2026-62293 Overview

CVE-2026-62293 is a stored cross-site scripting (XSS) vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. The hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without HTML escaping in Scanner.java. When a user scans an attacker-supplied Implementation Guide or profile and then opens or publishes the generated local or CI HTML report, attacker-controlled JavaScript executes in the report's browser context. The issue is fixed in version 6.9.11 and is classified under [CWE-20] Improper Input Validation.

Critical Impact
Attackers who supply malicious Implementation Guide or profile metadata can achieve stored JavaScript execution in the browser of any user who opens the resulting scan report.

Affected Products

HAPI FHIR org.hl7.fhir.core prior to version 6.9.11
HAPI FHIR validation module (org.hl7.fhir.validation) using the hidden scan command
Local and CI environments that render the generated scan.html report

Discovery Timeline

2026-08-07 - CVE-2026-62293 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-62293

Vulnerability Analysis

The vulnerability resides in the report-rendering path of Scanner.java within the HAPI FHIR validation module. The scanner builds an HTML report summarizing Implementation Guides (IGs) and profiles by concatenating string fields such as IG identifiers, presentation titles, and source references directly into an HTML buffer. The generated scan.html file is intended for local inspection or publication through continuous integration pipelines. Because the report renders in a browser context, any unescaped markup in the input becomes executable HTML and JavaScript. This is a classic stored XSS pattern where the attack payload is persisted in a generated artifact rather than a live web application.

Root Cause

The root cause is missing output encoding when writing attacker-influenced string fields into the HTML report. The vulnerable code concatenates values from ImplementationGuide.present() and the resource identifier s directly into <th> and <b title="..."> elements without calling an HTML escape function. Any Implementation Guide or profile authored by an attacker can embed script tags or HTML event handlers that are preserved verbatim in scan.html.

Attack Vector

An attacker publishes a FHIR Implementation Guide or profile containing malicious markup in title or source-reference fields. A victim retrieves and scans the resource using the HAPI FHIR hidden scan command, then opens the resulting scan.html locally or publishes it through a CI job. The victim's browser executes the injected JavaScript in the context of the report, allowing session token theft from any origin the report is hosted on, redirection, or further payload delivery. Exploitation requires user interaction to open the generated report.

java

// Patched code in org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java
b.append("<tr><th></th><th></th>");
for (String s : sort(igs)) {
  ImplementationGuide ig = getContext().fetchResource(ImplementationGuide.class, s);
  // Before: raw concatenation of s and ig.present()
  // After: values escaped with Utilities.escapeXml before insertion into HTML
  b.append("<th colspan=\"" + Integer.toString(profiles.get(s).size() + 1) + "\"><b title=\"" + Utilities.escapeXml(s) + "\">" + Utilities.escapeXml(ig.present()) + "</b></th>");
}
b.append("</tr>\r\n");
// Source: https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be

The patch wraps both the IG identifier and the display title with Utilities.escapeXml, neutralizing HTML metacharacters before they reach the report.

Detection Methods for CVE-2026-62293

Indicators of Compromise

Presence of <script> tags, javascript: URIs, or HTML event handler attributes (onerror, onload) inside generated scan.html files.
Implementation Guide or profile resources containing markup characters (<, >, ") inside title, name, or url fields.
Outbound HTTP requests from a developer workstation or CI runner triggered when opening a scan report.

Detection Strategies

Inventory build pipelines and developer tooling that invoke the HAPI FHIR scan command and identify installations running org.hl7.fhir.core prior to 6.9.11.
Statically scan generated scan.html artifacts for unescaped script markup before publication or archival.
Review ingested FHIR Implementation Guides for suspicious metadata containing HTML or JavaScript payloads.

Monitoring Recommendations

Alert on browser navigations to locally hosted or CI-hosted scan.html files that trigger unexpected outbound network activity.
Track dependency versions of org.hl7.fhir.core and org.hl7.fhir.validation across build systems, flagging versions below 6.9.11.
Log and review any FHIR IG imports from untrusted third parties prior to scanning.

How to Mitigate CVE-2026-62293

Immediate Actions Required

Upgrade org.hl7.fhir.core and dependent HAPI FHIR validation components to version 6.9.11 or later.
Audit CI jobs that publish scan.html reports and restrict publication to reports generated from trusted inputs.
Do not open or host scan reports built from Implementation Guides supplied by untrusted publishers until upgrading.

Patch Information

The fix is delivered in HAPI FHIR org.hl7.fhir.core version 6.9.11. It introduces Utilities.escapeXml around all attacker-influenced fields concatenated into the scan report. See the GitHub Security Advisory GHSA-6vcw-fq7v-4vhw and the upstream commit 3a9befd for the complete change set.

Workarounds

Avoid running the hidden scan command against Implementation Guides or profiles from untrusted sources.
Sanitize IG title, name, and source-reference fields before scanning, stripping HTML metacharacters.
Render scan.html output only in isolated browser profiles without access to authenticated sessions or sensitive origins.

bash

# Upgrade the vulnerable dependency in a Maven project
mvn versions:use-dep-version -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.core -DdepVersion=6.9.11 -DforceVersion=true
mvn clean verify