What is the CVSS score of CVE-2026-44696?

CVE-2026-44696 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-44696?

Yes, a patch is available for CVE-2026-44696. Update the affected software to the latest version immediately.

OpenProject CVE-2026-44696

EUVD-2026-39878 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 GitHub_M

XSS Openproject

5.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.7 MEDIUM

Network-accessible web app, low-privilege write access required (PR:L), victim must view content (UI:R), integrity-only UI manipulation impact with no confirmed confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:32 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This allows any authenticated user with write access to formattable text fields (work package descriptions, comments, project descriptions, news) to inject CSS This vulnerability is fixed in 17.4.0.

AnalysisAI

CSS injection in OpenProject's rich text rendering pipeline prior to version 17.4.0 allows any authenticated user with write access to inject arbitrary CSS into formattable text fields (work package descriptions, comments, project descriptions, news). The misconfigured Sanitize::Config::RELAXED[:css] setting permits all CSS properties on permitted HTML elements, enabling UI redressing, phishing overlays, and potential CSS-based side-channel data exfiltration when a victim views the malicious content. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vendor-released fix is available in 17.4.0.

Technical ContextAI

OpenProject is a Ruby-based web application for project management. Its rich text (Markdown) rendering pipeline uses the sanitize Ruby gem for HTML/CSS sanitization. The vulnerability stems from applying Sanitize::Config::RELAXED[:css] - an overly permissive preset that whitelists essentially all CSS properties - to inline style attributes on permitted HTML elements including figure, img, table, th, tr, and td. CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) is the root cause class: user-controlled CSS content is not adequately restricted before being rendered into the browser DOM. This enables style-based attacks such as position:fixed overlays, background-image out-of-band requests (a known CSS data exfiltration technique), and full-page UI manipulation. The affected CPE is cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*, indicating all OpenProject versions prior to the fix.

RemediationAI

Upgrade to OpenProject 17.4.0 or later, which replaces the overly permissive Sanitize::Config::RELAXED[:css] configuration with a restrictive CSS allowlist. The vendor advisory is at https://github.com/opf/openproject/security/advisories/GHSA-j9q2-49mp-hmq5. If immediate upgrade is not feasible, a compensating control is to restrict write access to formattable text fields (work package descriptions, comments, project descriptions, news) to trusted internal users only, removing write permissions from untrusted or externally-facing project members. This reduces the attacker pool but does not eliminate the vulnerability for privileged users. Content-Security-Policy headers that block inline styles (style-src 'none' or a strict nonce-based policy) could further limit CSS injection impact, though retrofitting CSP onto an existing application may break legitimate styling and requires testing.