EUVD-2026-39871Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R assigned because victims must navigate to the work package to trigger the payload, contra the official UI:N; all other metrics align with the provided vector.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachment and passes it to renderStreamMessage(). This executes arbitrary Turbo Stream actions - including redirect_to - in every victim's authenticated browser session, redirecting them to an attacker-controlled server. This vulnerability is fixed in 17.3.3 and 17.4.1.
AnalysisAI
Stored XSS in OpenProject's HTML sanitizer allows authenticated project contributors to execute arbitrary Turbo Stream actions - including forced redirects - in every other user's authenticated browser session. The sanitizer's :data wildcard for <macro> elements permits injection of data-controller attributes that Stimulus.js silently mounts, chaining an attacker-uploaded attachment through renderStreamMessage() to achieve cross-user session manipulation without victim interaction beyond viewing the work package. Patch-confirmed by vendor GitHub Security Advisory GHSA-q33w-f822-hg8x; no public exploit identified at time of analysis.
Technical ContextAI
OpenProject's frontend stack combines Stimulus.js (a lightweight JavaScript framework that auto-mounts controllers based on data-controller DOM attributes) with Turbo Streams (a Rails-based protocol for server-driven DOM updates via HTML fragments). The vulnerable sanitizer permits <macro> HTML elements with arbitrary data-* attributes via a :data allowlist wildcard instead of an explicit allowlist of safe attribute names. Because Stimulus.js scans the entire DOM for data-controller attributes and mounts matching controllers automatically, injecting data-controller="poll-for-changes" into a sanitized work package description is sufficient to invoke a built-in controller. That controller fetches an attacker-uploaded attachment URL and passes its content to renderStreamMessage(), which processes arbitrary Turbo Stream actions including redirect_to. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an overly permissive sanitizer allowlist enabling persistent script-equivalent behavior without <script> tags. Affected products are identified by CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:* covering all versions prior to the patched releases.
RemediationAI
Upgrade to OpenProject 17.3.3 (stable) or 17.4.1 (development) as confirmed by the vendor advisory at https://github.com/opf/openproject/security/advisories/GHSA-q33w-f822-hg8x. For deployments unable to upgrade immediately, restrict work package edit permissions to fully trusted internal users only - remove contributor-level access for external collaborators or untrusted accounts, which eliminates the attacker's ability to inject the malicious data-controller payload. As an additional compensating control, review and harden the deployment's Content Security Policy headers to restrict connect-src and frame-ancestors directives, which may partially limit the impact of Turbo Stream redirect_to actions by blocking attacker-controlled cross-origin destinations; however, CSP alone does not prevent the controller from mounting or fetching the attachment. Neither workaround substitutes for the patch, as the underlying sanitizer flaw remains exploitable by any user who retains edit access.
More in Openproject
View allA SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbi
OpenProject is web-based project management software. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
OpenProject is open source project management software. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardco
Cross-project folder hijacking in OpenProject before 17.3.3 and 17.4.1 lets a project-admin abuse an insecure direct obj
SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user
OpenProject has a CVSS 9.9 command injection vulnerability allowing authenticated users to execute OS commands on the pr
Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker wi
OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior
OpenProject (before 16.6.4) has a local file read vulnerability through SVG-based ImageMagick exploitation in the PDF ex
OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying
Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication toke
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today