Plane: Stored cross-site scripting in intake enables session token theft
Summary
Plane, an open-source project management tool, does not sanitize the HTML description of intake items submitted through the public intake feature (IntakeIssuePublicViewSet.create). Any authenticated user, including one without workspace membership, can store HTML in a project with a published DeployBoard and intake enabled. When a project member or viewer opens the planted link, JavaScript runs in their session and can steal a long-lived API token. The vulnerability is tracked as CWE-79 and CWE-862.
Affected
- Plane versions before 1.4.0 (advisory example: v1.3.1)
Fixed in
- Plane 1.4.0 or later (latest 1.4.x release recommended)
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'
- Not listed as known exploited (KEV: no)
Our recommendation
- Upgrade Plane to 1.4.0 or a later 1.4.x release.
- If an upgrade cannot be done immediately, disable public intake and DeployBoard publishing.
- Review existing intake items for suspicious links and HTML content.
- After patching, rotate API tokens if compromise is suspected.
- Restrict self-registration on internet-facing instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hh2r-3hwp-mvq3 github.com
- Plane v1.4.0 release github.com
- Fix commit 0d58adb github.com
- Pull request #9287 github.com
- OSV entry CVE-2026-104979 osv.dev
- Strix CVE-2026-104979 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:34.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1
- https://github.com/makeplane/plane/pull/9287
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-hh2r-3hwp-mvq3
- https://github.com/makeplane/plane/security/advisories/GHSA-hh2r-3hwp-mvq3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.