CVE-2026-102982
Plane is an open-source project management tool
- Risk score
- 57/100
- CVSS
- 8.5 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixe…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
- https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1
- https://github.com/makeplane/plane/pull/9287
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j
Original description
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
Last activity 13 Oct 2026. Patch Forecast updates every hour.