CVE-2026-102982: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in makeplane plane
Description
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
CVSS v4.0
Score 8.5high
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Plane versions before 1.4.0 contain a CWE-79 improper neutralization of input vulnerability in the handling of comment_html. Unsafe URL schemes are not sanitized, enabling stored cross-site scripting attacks. An attacker with project member privileges can embed malicious links in comments, which execute scripts in other users' browsers upon interaction. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity. The issue is resolved in version 1.4.0.
Potential Impact
Successful exploitation allows attacker-controlled script execution in the browser context of other users who interact with the crafted link in comments. This can lead to session hijacking, unauthorized actions, or data exposure within the Plane application context. The vulnerability requires at least low privileges (project member) and user interaction (clicking the link).
Mitigation Recommendations
Upgrade Plane to version 1.4.0 or later, where the vulnerability is fixed by proper sanitization of unsafe URL schemes in comments. No additional mitigation is required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-29T20:46:08.333Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace52f62cdf04f65680e4f3
Added to database: 10/13/2026, 15:49:10 UTC
Last enriched: 10/13/2026, 16:03:32 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.