CVE-2026-102982: Plane: XSS in work item comments
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what user interaction is required?
A project member can exploit it by storing a crafted link in a work item comment. Script execution occurs in another user's browser only if that user selects the malicious link.
Which deployments are affected?
Plane versions prior to 1.4.0 are affected. The issue is fixed in Plane 1.4.0.
What should teams do if they cannot upgrade immediately?
The provided information does not specify a workaround. Until upgrading, treat links in work item comments from project members as potentially unsafe and avoid selecting suspicious links.