Answer in brief
CVE-2026-62293 records a Unknown severity vulnerability in HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles. The current sources do not mark it as known exploited. The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic), hapifhir/org.hl7.fhir.core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic), hapifhir/org.hl7.fhir.core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validationgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cligeneric | < 6.9.11 | Not reported |
| hapifhir/org.hl7.fhir.coregeneric | < 6.9.11 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-62293 records a Unknown severity vulnerability in HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles. The current sources do not mark it as known exploited. The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic), hapifhir/org.hl7.fhir.core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic), hapifhir/org.hl7.fhir.core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validationgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cligeneric | < 6.9.11 | Not reported |
| hapifhir/org.hl7.fhir.coregeneric | < 6.9.11 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.
Quoted source text, attributed separately from HOL analysis.