Plane: Stored cross-site scripting in work item comments
Summary
Plane, an open-source project management tool, did not sanitize unsafe URL schemes in comment HTML before version 1.4.0. A project member can store a crafted link in a comment, and attacker-controlled script then runs in the browser of another user who selects that link. The CVSS 4.0 score is 8.5 (HIGH), with high confidentiality and integrity impact and no availability impact.
Affected
- Plane (makeplane/plane) versions before 1.4.0
Fixed in
- Plane 1.4.0
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation status poc (proof of concept available), automatable: no, technical impact: total.
- The advisory describes how to reproduce the issue. No evidence of in-the-wild exploitation was found.
Our recommendation
- Inventory all self-hosted Plane instances and their versions.
- Upgrade to Plane 1.4.0 or later as soon as possible.
- Review which users can post comments, especially external guests or shared project boards.
- Instruct users not to open links from untrusted comments until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6qrq-f73q-r67j github.com
- Plane release v1.4.0 github.com
- Fix commit 0d58adb (WEB-7774) github.com
- Pull request #9287 github.com
- OSV entry CVE-2026-102982 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:44.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1
- https://github.com/makeplane/plane/pull/9287
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.