CVE-2026-52781
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachment and passes it to renderStreamMessage(). This executes arbitrary Turbo Stream actions — including redirect_to — in every victim's authenticated browser session, redirecting them to an attacker-controlled server. This vulnerability is fixed in 17.3.3 and 17.4.1.
Summary dbcve.org
OpenProject's HTML sanitizer misconfiguration allows data-controller attributes on macro elements, enabling Stimulus.js to execute arbitrary Turbo Stream actions including unauthorized redirects in authenticated user sessions.
Mitigation
Upgrade OpenProject to version 17.3.3 or 17.4.1 to remediate the HTML sanitizer vulnerability.