CVE-2026-104979 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane versions prior to 1.4.0 represents a critical stored cross-site scripting flaw rooted in insufficient input validation within the project management interface. Specifically, the IntakeIssuePublicViewSet.create method allows authenticated users to inject arbitrary HTML content into issue descriptions via the description_html field. This occurs because the system fails to invoke the nh3 library's validate_html_content function during the creation process, leaving a direct path for malicious markup to be persisted in the database without sanitization or encoding of dangerous script elements.
The attack vector is particularly insidious due to its reliance on social engineering and specific application configurations. An attacker can exploit this by creating an issue with embedded JavaScript payloads disguised as benign links within the description field. This exploitation requires that the target project has a published DeployBoard with intake functionality enabled, which exposes the input fields to authenticated users regardless of their workspace membership status. Consequently, even new accounts with no prior permissions or associations with specific workspaces can execute this attack, broadening the potential scope of compromise significantly beyond traditional privilege escalation scenarios.
The operational impact is severe because it leads to session hijacking and data exfiltration through a sophisticated bypass mechanism involving TipTap parsers. When an authorized project member or viewer interacts with the malicious content by clicking on the planted link, the application's frontend parser fails to properly neutralize javascript: URI schemes due to a specific parsing flaw in TipTap. This allows the embedded script to execute within the context of the victim's browser session. The payload is designed to exfiltrate long-lived API tokens stored in the client-side environment, granting the attacker persistent access to the compromised account and potentially allowing further lateral movement across connected systems or data theft without requiring additional authentication steps.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause of cross-site scripting flaws. From an offensive security perspective, it maps directly to MITRE ATT&CK technique T1059.007, representing command and script interpretation via browser-based execution, specifically leveraging stored payloads for persistence and impact. The failure to sanitize rich text inputs before storage is a classic architectural oversight that underscores the necessity of strict allow-listing strategies for HTML content in web applications handling user-generated data.
To mitigate this risk, organizations must immediately upgrade Plane to version 1.4.0 or later where the validation logic has been corrected to properly invoke nh3 and sanitize all incoming HTML content before database persistence. In environments where an immediate upgrade is not feasible, temporary mitigations should include disabling intake features on public-facing boards until patches are applied, implementing strict Content Security Policy headers that restrict script execution from untrusted sources, and reviewing existing issues for any signs of injected malicious scripts. Regular security audits focusing on input validation in rich text editors are essential to prevent similar vulnerabilities in the future.