CVE-2026-102982
Deferred Deferred - Pending Action

Stored XSS in Plane Project Comments via Unsafe URL Schemes

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-102982
EUVD
EUVD-2026-98817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Plane project management tool. It occurs because comments fail to sanitize unsafe URL schemes stored in comment_html. An attacker with project member permissions can inject a malicious link into a comment. When another user clicks this link, the embedded script executes in their browser, potentially leading to unauthorized actions or data theft.

Detection Guidance

Check Plane application version. If running versions prior to 1.4.0, the system is vulnerable. Inspect comments for crafted links or unusual HTML content. Use browser developer tools to monitor for unexpected script execution when clicking links in comments.

Impact Analysis

If you use Plane versions before 1.4.0, an attacker could trick you into clicking a malicious link in a comment. This could allow them to steal your session cookies, perform actions on your behalf, or access sensitive data you can view in Plane. The impact depends on your permissions in the workspace.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected Plane versions may face compliance violations if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. Review and remove any suspicious comments containing scripts or unsafe links. Implement additional monitoring for unauthorized actions or data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart