Cross-Site Scripting in Plane Project Management Tool

CVE-2026-102982

What is CVE-2026-102982?

The Plane Project Management Tool had a vulnerability where comments did not properly sanitize unsafe URL schemes before storing them in comment_html. This allowed users to inadvertently execute attacker-controlled scripts in their browser. When a project member clicks on a crafted link present in a comment, it could lead to unwanted script execution in the context of their session. This issue has been addressed in version 1.4.0, providing a necessary security enhancement.

References