CVE-2026-102982
Severity not reportedData quality: partial.
Some fields were not provided by the source.
Plane is an open-source project management tool.
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
CVSS
—
Not reported by the source
Timeline (UTC)
Published: 2026-10-13 16:17
Modified: 2026-10-13 17:17
NVD status: Deferred
Last synced 1 day ago
Verified against the source API 2026-10-27 06:59 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1 security-advisories@github.com
- https://github.com/makeplane/plane/pull/9287 security-advisories@github.com
- https://github.com/makeplane/plane/releases/tag/v1.4.0 security-advisories@github.com
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j security-advisories@github.com
- https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:59 UTC · record ↗