CVE-2026-62293

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.11

Description A stored cross-site scripting issue exists in the hidden scan command within Scanner.java. The application concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into the scan.html file without proper escaping. This allows an attacker to execute arbitrary JavaScript in the browser context of a user who opens or publishes the generated local or CI HTML report after scanning a malicious IG or profile.

Recommendations Update to version 6.9.11.