OpenProject’s markdown renderer fails to properly validate hyperlink payloads prior to version 17.2.0. The flaw permits an attacker to embed malicious hyperlinks that exploit DOM clobbering, which can overwrite native browser DOM functions with injected HTML elements. Key weakness identified as CWE‑79 (XSS via DOM clobbering). When an injection occurs, the application’s JavaScript execution is interrupted, resulting in a full page crash or blank screen and halting further application logic.

Affected systems are installations of the open‑source, web‑based project management software OpenProject, provided by the vendor opf. All versions published before the 17.2.0 release are susceptible; the issue was resolved in the 17.2.0 patch.

The CVSS score is 6.5, indicating moderate severity. EPSS is less than 1 %, suggesting the probability of exploitation is low. The vulnerability is not catalogued in CISA’s KEV list. Exploitation would require an attacker able to inject markdown content—such as a user with content author privileges—into the application. Once a proper payload is inserted, the DOM clobbering triggers a runtime error during initialization, leading to a denial of service. No publicly documented exploit exists yet, but the flaw is classified as a medium‑risk issue.