PT-2026-24739 · Git+2 · Openproject

Frozzipies · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-30235

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.0

Description OpenProject is an open-source, web-based project management software. A flaw exists due to improper validation of Markdown rendering, specifically in hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM clobbering. DOM clobbering can cause the entire page to crash or become blank by overwriting native DOM functions with HTML elements, leading to runtime errors during application initialization and halting further execution.

Recommendations Versions prior to 17.2.0 should be updated to version 17.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30235

GHSA-9RV2-9XV5-GPQ8

Affected Products

Openproject

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30235.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-9rv2-9xv5-gpq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30235 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30235 · Vendor Advisory
• https://t.me/CVEtracker/47146 · Telegram Post
• https://twitter.com/CVEnew/status/2032998310139576805 · Twitter Post