Executive brief
OpenProject, a web-based project management platform, contains a vulnerability in how it handles rich text formatting. An authenticated user can inject malicious styling code into shared areas like project descriptions or comments. This could be used to create fake login screens to steal credentials from other users or silently track when and where users are viewing specific project tasks.
Technical details
A stored CSS injection vulnerability exists in OpenProject prior to version 17.4.0. The markdown rendering pipeline in 'sanitization_filter.rb' utilizes 'Sanitize::Config::RELAXED[:css]', which permits nearly all CSS properties within style attributes on specific HTML elements (figure, img, table, th, tr, td). An authenticated attacker with write access to formattable fields—such as work package descriptions, comments, or news—can inject malicious CSS. This can be leveraged to create full-screen phishing overlays using 'position:fixed' and 'z-index', or to exfiltrate user metadata (IP, User-Agent) via 'background-image:url()' callbacks. The vulnerability is resolved by implementing a strict whitelist of allowed CSS properties.
Affected products
- OpenProject OpenProject < 17.4.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: NVD publication date