CVE-2026-30235: OpenProject DOM Clobbering XSS Vulnerability

CVE-2026-30235 Overview

CVE-2026-30235 is a DOM clobbering vulnerability in OpenProject, an open-source, web-based project management software. The vulnerability stems from improper validation in OpenProject's Markdown rendering, specifically in hyperlink handling. This flaw allows attackers to inject malicious hyperlink payloads that perform DOM clobbering attacks, which can crash or blank the entire page by overwriting native DOM functions with HTML elements. When exploited, critical JavaScript calls throw runtime errors during application initialization, halting further execution and rendering the application unusable.

Critical Impact

Attackers can exploit improper Markdown hyperlink validation to inject DOM clobbering payloads, causing application-wide denial of service by crashing or blanking pages during JavaScript initialization.

Affected Products

• OpenProject versions prior to 17.2.0

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-30235 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30235

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Cross-Site Scripting) and manifests through improper input validation in OpenProject's Markdown rendering engine. The flaw specifically resides in how hyperlinks are processed and rendered within the application. When Markdown content containing specially crafted hyperlinks is processed, the application fails to properly sanitize or validate the link attributes, enabling DOM clobbering attacks.

DOM clobbering is a technique where attackers inject HTML elements that override native browser DOM properties or methods. In this case, attackers can craft malicious hyperlink payloads within Markdown content that, when rendered, create HTML elements with id or name attributes that shadow critical JavaScript variables or DOM methods. This causes the application's JavaScript to malfunction during initialization, as legitimate code attempts to access now-clobbered DOM properties.

The attack can be executed by any authenticated user who can input Markdown content that gets rendered within the OpenProject interface. Once the malicious payload is rendered in a victim's browser, it disrupts the application's normal JavaScript execution flow.

Root Cause

The root cause is insufficient validation and sanitization of hyperlink attributes during Markdown-to-HTML conversion. OpenProject's Markdown parser does not adequately restrict or escape certain HTML attributes that can be abused for DOM clobbering. Specifically, the hyperlink handling code fails to prevent the injection of id or name attributes that conflict with JavaScript global variables or DOM properties used by the application during page initialization.

Attack Vector

The attack is network-based and requires low privileges (an authenticated user account). An attacker can inject malicious Markdown content containing crafted hyperlinks into areas where Markdown is rendered, such as project descriptions, comments, or work package content. When another user views the page containing the malicious payload, the DOM clobbering attack executes in their browser context.

The malicious hyperlink payload manipulates the rendered HTML structure to include elements whose id or name attributes match critical JavaScript variables. When the browser's JavaScript engine attempts to access these variables during application initialization, it instead retrieves the attacker-controlled HTML elements, causing type errors and runtime exceptions that halt application execution.

For detailed technical information about the vulnerability mechanism and exploitation techniques, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-30235

Indicators of Compromise

• Unusual Markdown content containing nested or complex hyperlink structures with suspicious id or name attributes
• User reports of pages crashing, blanking, or failing to load properly after viewing specific project content
• Browser console errors showing JavaScript runtime exceptions related to DOM property access during page initialization

Detection Strategies

• Monitor browser-side JavaScript errors for patterns indicating DOM clobbering attempts, such as unexpected type errors when accessing known DOM properties
• Implement Content Security Policy (CSP) headers to help detect and mitigate injection attacks
• Review user-generated Markdown content for suspicious hyperlink patterns that include potentially dangerous HTML attributes
• Deploy web application firewalls (WAF) with rules to detect DOM clobbering payloads in request bodies

Monitoring Recommendations

• Enable logging for Markdown content submissions and monitor for unusual patterns in hyperlink structures
• Set up alerts for increased rates of client-side JavaScript errors that may indicate exploitation attempts
• Track user sessions where pages fail to render and correlate with recently viewed content containing Markdown

How to Mitigate CVE-2026-30235

Immediate Actions Required

• Upgrade OpenProject to version 17.2.0 or later immediately
• Review recent Markdown content submissions for potentially malicious hyperlink payloads
• Consider temporarily restricting Markdown hyperlink functionality until the patch is applied
• Notify users about the vulnerability and advise them to report any page rendering issues

Patch Information

OpenProject has addressed this vulnerability in version 17.2.0. The fix implements proper validation and sanitization of hyperlink attributes during Markdown rendering to prevent DOM clobbering attacks. Organizations should upgrade to version 17.2.0 or later to receive the security patch. For additional details, see the GitHub Security Advisory.

Workarounds

• Implement server-side HTML sanitization to strip potentially dangerous attributes (id, name) from rendered Markdown hyperlinks
• Deploy a reverse proxy or WAF rule to filter Markdown content containing suspicious hyperlink patterns
• Restrict Markdown editing privileges to trusted users until the patch can be applied
• Enable strict Content Security Policy headers to limit the impact of DOM manipulation attacks

# Example: Upgrade OpenProject to patched version
# Using Docker Compose
docker-compose pull openproject
docker-compose up -d openproject

# Verify version after upgrade
docker exec openproject bundle exec rails runner "puts OpenProject::VERSION"