CVE-2026-52781

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1

Description The HTML sanitizer allows <macro> elements to have unrestricted data-* attributes through a :data wildcard. An attacker can inject data-controller="poll-for-changes" into a work package description, which triggers Stimulus.js to mount a controller. This process fetches an attacker-uploaded attachment and passes it to the renderStreamMessage() function, enabling the execution of arbitrary Turbo Stream actions, such as redirect to, within the authenticated browser session of any victim. This can result in users being redirected to a server controlled by the attacker.

Recommendations Update to version 17.3.3. Update to version 17.4.1.