CVE-2026-102982 Details
Description
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
A stored cross-site scripting vulnerability has been identified in Makeplane Plane, prior to version 1.4.0. The issue arises because comments can include unsafe URL schemes that are not properly sanitized. When a project member adds a crafted link in a comment, it can execute an attacker-controlled script in the browser of another user who clicks the link.
Users are advised to upgrade to Plane version 1.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1 | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/pull/9287 | [email protected] | Issue TrackingVendor |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| makeplane Plane | <= 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |