PT-2026-24739 · Git+2 · Openproject

Frozzipies · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-30235

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.0

Description OpenProject is an open-source, web-based project management software. A flaw exists due to improper validation of Markdown rendering, specifically in hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM clobbering. DOM clobbering can cause the entire page to crash or become blank by overwriting native DOM functions with HTML elements, leading to runtime errors during application initialization and halting further execution.

Recommendations Versions prior to 17.2.0 should be updated to version 17.2.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-30235

GHSA-9RV2-9XV5-GPQ8

Produtos afetados

Openproject

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30235.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-9rv2-9xv5-gpq8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30235 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-30235 · Aviso do Fabricante
• https://t.me/CVEtracker/47146 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032998310139576805 · Publicação no Twitter