---
id: CVE-2026-102982
title: Plane is an open-source project management tool
summary: >-
  Plane is an open-source project management tool. Prior to 1.4.0, the plane
  comments fail to sanitize unsafe URL schemes stored in comment_html. A project
  member can store a crafted link in a comment, and attacker-controlled script
  execut…
severity: none
cwe:
  - CWE-79
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:14.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102982'
references:
  - url: >-
      https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1
    label: security-advisories@github.com
  - url: 'https://github.com/makeplane/plane/pull/9287'
    label: security-advisories@github.com
  - url: 'https://github.com/makeplane/plane/releases/tag/v1.4.0'
    label: security-advisories@github.com
  - url: 'https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j'
    label: security-advisories@github.com
  - url: 'https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-13T16:35:46.736Z'
---

## Overview

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.