CVE-2026-10850: Plane 1.3.1 - Stored XSS in intake issue description_html
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable acceptance and storage of raw HTML/JavaScript in the description_html field. Accept only plain-text or apply server-side sanitization/escaping of HTML before storing or rendering.
Plane CE API v1 intake endpoint description_html_allowed = false - Configuration
Prevent low-privileged project members from submitting HTML/JavaScript by requiring higher privileges to set the description_html field or disallowing HTML input for lower roles.
Plane CE API v1 intake endpoint intake_submission_role_requirement = restrict_low_privilege - Compensating control
Restrict access to the API v1 intake endpoint at the network perimeter (trusted IP ranges/internal network) and ensure strict authentication and RBAC enforcement for intake creation until an application-level fix is applied.
- Operational
Audit existing intake work items for stored HTML/JavaScript in the description_html field; remove or sanitize malicious content and monitor logs/alerts for repeated or suspicious submissions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10850?
The severity of CVE-2026-10850 is rated as medium with a CVSS score of 6.9.
How do I fix CVE-2026-10850?
To fix CVE-2026-10850, ensure that proper input validation and sanitization are applied to the description_html field to prevent XSS vulnerabilities.
What impact does CVE-2026-10850 have?
CVE-2026-10850 allows low-privileged users to inject arbitrary HTML and JavaScript, which can lead to stored cross-site scripting (XSS) attacks.
Who is affected by CVE-2026-10850?
CVE-2026-10850 affects users of Plane CE version 1.3.1 who have low-privileged access to the API.
When was CVE-2026-10850 published?
CVE-2026-10850 was published on June 17, 2026.