Is CVE-2026-52781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52781 being exploited in the wild.

How severe is CVE-2026-52781?

Medium severity, with a CVSS score of 6.4, published 26 June 2026.

Which products and versions are affected?

opf OpenProject = 17.4.0 < 17.4.1.

Is there a fix for CVE-2026-52781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52781 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52781?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52781: OpenProject stored XSS in work package descriptions

Q: Is there a fix for CVE-2026-52781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-52781 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52781?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52781 · Severity: medium · CVSS 6.4 · Published 2026-06-26

OpenProject is an open-source project management platform used for tracking tasks and team collaboration. A security flaw in how the software handles project descriptions allows an attacker to inject malicious code that can hijack a user's session. If exploited, this could lead to users being redirected to malicious websites or having their authenticated sessions manipulated without their knowledge.

Quick answers

Is CVE-2026-52781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52781 being exploited in the wild.
How severe is CVE-2026-52781?: Medium severity, with a CVSS score of 6.4, published 26 June 2026.
Which products and versions are affected?: opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1.
Is there a fix for CVE-2026-52781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52781 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52781?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in OpenProject due to an overly permissive HTML sanitizer that allows unrestricted 'data-*' attributes on '<macro>' elements. By injecting a 'data-controller="poll-for-changes"' attribute into a work package description, an attacker can trigger Stimulus.js to mount a controller. This controller fetches an attacker-controlled attachment and passes it to 'renderStreamMessage()', enabling the execution of arbitrary Turbo Stream actions. This can be used to perform actions like 'redirect_to' within the context of a victim's authenticated session. The vulnerability is fixed in versions 17.3.3 and 17.4.1.

Affected products

opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1

Timeline

2026-06-08: advisory: Vendor advisory published on GitHub
2026-06-26: disclosed: CVE published to NVD

References

https://github.com/opf/openproject/security/advisories/GHSA-q33w-f822-hg8x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.