CVE-2026-44696 Overview
CVE-2026-44696 affects OpenProject, an open-source web-based project management platform. Versions prior to 17.4.0 use the Sanitize::Config::RELAXED[:css] configuration for inline style sanitization in the rich text (markdown) rendering pipeline. This configuration permits nearly all CSS properties on style attributes for elements including figure, img, table, th, tr, and td. Any authenticated user with write access to formattable text fields can inject malicious CSS into work package descriptions, comments, project descriptions, and news items. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject arbitrary CSS into rendered content, enabling UI redressing, content spoofing, and data exfiltration through CSS-based side channels.
Affected Products
- OpenProject versions prior to 17.4.0
- OpenProject rich text (markdown) rendering pipeline
- Formattable fields: work package descriptions, comments, project descriptions, news
Discovery Timeline
- 2026-06-26 - CVE-2026-44696 published to NVD
- 2026-06-27 - Last updated in NVD database
Technical Details for CVE-2026-44696
Vulnerability Analysis
The vulnerability resides in OpenProject's markdown rendering pipeline. The application invokes the Sanitize gem with the RELAXED[:css] preset when processing user-supplied rich text. This preset was designed for permissive CSS use cases and allows the majority of CSS properties inside style attributes on permitted HTML elements. Attackers with a valid account and write access to any formattable field can embed styling that manipulates layout, hides interface elements, or exfiltrates data through CSS request-based side channels such as background image URLs targeting attacker-controlled servers.
The issue is a CSS injection variant of [CWE-79]. While traditional script execution is blocked, CSS provides sufficient primitives to overlay fake UI, spoof legitimate content, and leak data using attribute selectors combined with external resource loads. The EPSS score indicates a low probability of exploitation activity at present.
Root Cause
The root cause is the use of an overly permissive sanitization configuration. Sanitize::Config::RELAXED[:css] does not enforce an allowlist of safe CSS properties and permits values that trigger network requests, positioning changes, and rendering behaviors suitable for abuse.
Attack Vector
Exploitation requires an authenticated user with write access to any rich text field. The attacker submits markdown or HTML containing a style attribute on an allowed element such as figure or td. When another user renders the affected view, the injected CSS is applied to their browser session. See the GitHub Security Advisory for advisory-level technical details.
// No verified public exploit code is available.
// Refer to the vendor advisory for technical specifics of the injection surface.
Detection Methods for CVE-2026-44696
Indicators of Compromise
- Unusual style attributes on figure, img, table, th, tr, or td elements stored in work package descriptions, comments, or news entries
- CSS properties referencing external URLs via background-image, background, list-style-image, or @import
- Outbound HTTP requests from user browsers to unfamiliar domains triggered when viewing OpenProject content
Detection Strategies
- Query the OpenProject database for stored rich text containing style= attributes with url( values or absolute positioning directives
- Review reverse proxy or web application firewall logs for POST requests to work package and comment endpoints containing suspicious CSS payloads
- Monitor client-side Content Security Policy violation reports for blocked external resource loads originating from rendered OpenProject pages
Monitoring Recommendations
- Enable audit logging for edits to work package descriptions, comments, project descriptions, and news items
- Track anomalous edit patterns from lower-privileged accounts touching high-visibility fields
- Correlate egress DNS and HTTP telemetry with rendered OpenProject sessions to identify CSS-triggered exfiltration attempts
How to Mitigate CVE-2026-44696
Immediate Actions Required
- Upgrade OpenProject to version 17.4.0 or later, which replaces the relaxed CSS configuration with a stricter allowlist
- Audit existing rich text content for previously injected style attributes and remove suspicious values
- Review user permissions and remove write access from accounts that do not require it
Patch Information
The vulnerability is fixed in OpenProject 17.4.0. The patch replaces Sanitize::Config::RELAXED[:css] with a restricted CSS property allowlist for the rich text rendering pipeline. Refer to the GitHub Security Advisory GHSA-j9q2-49mp-hmq5 for full remediation details.
Workarounds
- Restrict write access to formattable fields until the upgrade to 17.4.0 is deployed
- Deploy a strict Content Security Policy that blocks external image and font loads from user-generated content
- Apply a reverse proxy rule to strip style attributes from inbound rich text submissions to OpenProject endpoints
# Upgrade OpenProject via package manager to the patched release
sudo openproject reconfigure
sudo apt-get update && sudo apt-get install --only-upgrade openproject=17.4.0
sudo openproject restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
