# CVE-2026-52781: OpenProject stored XSS in work package descriptions

Source: https://junglewise.ai/threats/cve-2026-52781-openproject-stored-xss-in-work-package-descriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-52781 · Severity: medium · CVSS 6.4 · Published 2026-06-26

OpenProject is an open-source project management platform used for tracking tasks and team collaboration. A security flaw in how the software handles project descriptions allows an attacker to inject malicious code that can hijack a user's session. If exploited, this could lead to users being redirected to malicious websites or having their authenticated sessions manipulated without their knowledge.

## Quick answers

**Is CVE-2026-52781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52781 being exploited in the wild.

**How severe is CVE-2026-52781?** Medium severity, with a CVSS score of 6.4, published 26 June 2026.

**Which products and versions are affected?** opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1.

**Is there a fix for CVE-2026-52781?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52781 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52781?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in OpenProject due to an overly permissive HTML sanitizer that allows unrestricted 'data-*' attributes on '<macro>' elements. By injecting a 'data-controller="poll-for-changes"' attribute into a work package description, an attacker can trigger Stimulus.js to mount a controller. This controller fetches an attacker-controlled attachment and passes it to 'renderStreamMessage()', enabling the execution of arbitrary Turbo Stream actions. This can be used to perform actions like 'redirect_to' within the context of a victim's authenticated session. The vulnerability is fixed in versions 17.3.3 and 17.4.1.

## Affected products

- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1

## Timeline

- 2026-06-08: advisory: Vendor advisory published on GitHub
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/opf/openproject/security/advisories/GHSA-q33w-f822-hg8x](https://github.com/opf/openproject/security/advisories/GHSA-q33w-f822-hg8x)