High · published January 19, 2026
⚡ OpenProject's roadmap view has a sneaky XSS vulnerability that could let an attacker inject malicious HTML just by naming a subproject! 😱 Think of it like a restaurant placing orders without checking the customer's name — if they use a name that includes a hidden message, it gets served to everyone. This flaw allows any HTML in a subproject name to show up right in your web application's interface! This means a crafty attacker could inject harmful scripts that run in the browser of anyone viewing the roadmap, potentially stealing sensitive data or hijacking sessions. Imagine the chaos if every meal served also included an unfiltered side of malicious content!
Think of it like a restaurant placing orders without checking the customer's name — if they use a name that includes a hidden message, it gets served to everyone. This flaw allows any HTML in a subproject name to show up right in your web application's interface! In OpenProject versions 16.3.0 through 16.6.4, the helper function renders user-controlled project names directly into the page without proper escaping, leading to stored cross-site scripting (XSS) vulnerabilities. The issue has been addressed in versions 16.6.5 and 17.0.0 by implementing a security header that prevents content type sniffing.
This means a crafty attacker could inject harmful scripts that run in the browser of anyone viewing the roadmap, potentially stealing sensitive data or hijacking sessions. Imagine the chaos if every meal served also included an unfiltered side of malicious content! To protect your instance, immediately upgrade to version 16.6.5 or 17.0.0. If upgrading isn’t feasible, you should manually add the `X-Content-Type-Options: nosniff` header in your web server configuration to help mitigate the risk. Don’t wait too long; this is a high-priority fix! You've got this! With these steps, you can secure your application and keep the malicious chefs out of your kitchen! 🛡️