The vulnerability in OpenProject arises from the HTML sanitizer granting <macro> elements unrestricted data-* attributes via a :data wildcard. An attacker can inject data-controller="poll-for-changes" into a work package description, causing the Stimulus.js framework to mount a controller that fetches an attacker-uploaded attachment and passes it to renderStreamMessage(). This results in execution of arbitrary Turbo Stream actions, including redirect_to, in every authenticated user's browser session, enabling redirection to attacker-controlled servers. The issue is addressed in OpenProject versions 17.3.3 and 17.4.1.

Successful exploitation allows an attacker with at least low privileges to execute arbitrary Turbo Stream actions in the context of authenticated users, leading to potential redirection to malicious sites. This compromises user session integrity and may facilitate further attacks such as phishing or session hijacking. The CVSS score of 6.4 reflects a medium severity impact with low attack complexity and no user interaction required.

This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least one of these versions to remediate the issue. No additional mitigations are specified or required once patched.