CVE-2026-102982

Executive Summary

CVE-2026-102982 is a stored cross-site scripting (XSS) vulnerability in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The flaw allows a project member to store a crafted link using an unsafe URL scheme within a comment, which executes attacker-controlled JavaScript in the browser context of another user who selects that link. The CVSS score and vector are not officially assigned (N/A); the vector above is an inferred estimate only, reflecting the authenticated, user-interaction nature of the flaw.

Technical Analysis

The vulnerability resides in Plane's comment handling mechanism. Prior to version 1.4.0, Plane fails to sanitize unsafe URL schemes stored in the comment_html field. The NVD description explicitly identifies the comment_html field as the storage location for the crafted link. The core issue is the lack of validation on URL schemes when a project member submits a comment containing a hyperlink. When another user later views the comment and selects the link, the browser navigates to the attacker-controlled URL, and script executes in the context of that user's session.

This is a stored XSS vulnerability (CWE-79). Because the malicious content is persisted in the application's data store (the comment), it does not require the victim to click a link from an external source — the payload is delivered within the Plane interface itself. The "unsafe URL schemes" phrasing indicates that the sanitization failure concerns the scheme component of a URL (for example, permitting schemes that can execute script) rather than HTML tag injection. This is the classic "javascript: URI" class of XSS, in which an <a href="javascript:..."> link, when clicked, executes arbitrary script in the origin's context. The description does not specify which schemes are blocked or permitted, so no further implementation detail can be asserted.

Attack surface: the comment creation endpoint accepts member-supplied content that is stored as comment_html. Any project member with permission to post comments can plant a payload. The victim need only view the comment and select the link. No details of the exact rendering or click-handling code are available in the description, so no specific function or parameter names beyond comment_html may be asserted.

At the version boundary, the issue is "fixed in version 1.4.0," implying that the sanitization logic for URL schemes in comment_html was corrected. No patch commit or diff is available in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class. No specific function names, endpoints, or parameters beyond comment_html are invented.

1. Reconnaissance / Target Identification: The attacker identifies a Plane instance running a version prior to 1.4.0. Access requires membership in a project, since the payload must be stored as a comment by a project member. The attacker confirms the ability to create or edit a comment.

2. Triggering the Flaw: The attacker creates a comment whose content includes a crafted link using an unsafe URL scheme. This content is stored in comment_html by the application without adequate sanitization of the URL scheme. The mechanism at the vulnerability-class level: the application fails to reject or neutralize a URL scheme that permits script execution when the link is selected.

3. Payload / Execution Method: When a second user views the comment and selects the stored link, the attacker-controlled script executes in that user's browser context — i.e., within the Plane origin and the victim's authenticated session. This is the defining mechanism of a stored DOM/browser-context XSS delivered via a dangerous URL scheme.

4. Post-Exploitation Impact: Script running in the victim's browser context can act with the victim's privileges and session. Depending on the victim's role, this could include reading or modifying project data, performing actions as the victim, or exfiltrating data accessible to the victim's session. The description does not detail specific post-exploitation behaviors, so no additional capabilities are asserted.

Impact Assessment

This is a stored XSS affecting authenticated users of Plane (prior to 1.4.0) who are project members and who interact with a comment containing the crafted link. Because the exploit requires the attacker to be a project member and requires the victim to select the link, the attack is authenticated and interaction-dependent.

Business impact: an attacker with project membership can execute arbitrary script in another user's authenticated browser session, enabling actions such as data manipulation or exfiltration bounded by that user's permissions. Blast radius is limited to users who view and select the malicious link within a shared project. In self-hosted or enterprise deployments, this can enable lateral movement within the project context and potential disclosure of sensitive project information.

CVSS: The official CVSS score and vector are N/A (not officially assigned). No CVSS subscores are available from the provided data; none are fabricated here. Any scoring should follow FIRST.org guidance for stored XSS with privileged (member-level) attacker, user interaction required, and scope change potential.

Detection Guidance

Sigma Rule

Detects creation of comments containing potentially dangerous URL schemes.

title: Plane Comment Stored XSS via Unsafe URL Scheme (CVE-2026-102982)
id: 3f6c9b21-7a44-4d8e-9b2a-plane0001
status: experimental
description: Detects Plane API requests creating comments whose comment_html contains unsafe URL schemes
logsource:
  product: plane
  category: web
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: '/comments'
  selection_payload:
    request_body|contains:
      - 'javascript:'
      - 'data:'
      - 'vbscript:'
      - 'file:'
      - 'comment_html'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate documentation referencing the literal string "javascript:"
level: medium
tags:
  - attack.t1204.001
  - cve.2026.102982

YARA Rule

rule CVE_2026_102982_Plane_Comment_Unsafe_URL_Scheme
{
    meta:
        description = "Detects Plane comment payloads using unsafe URL schemes for stored XSS (CVE-2026-102982)"
        author = "valtersit.com"
        reference = "CVE-2026-102982"
        date = "2026-01-01"
    strings:
        $a = "comment_html" nocase
        $b = "javascript:" nocase
        $c = "data:text/html" nocase
        $d = "vbscript:" nocase
        $e = "<a href" nocase
    condition:
        $a and ($b or $c or $d) or ($e and ($b or $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102982 Plane Comment Stored XSS Unsafe URL Scheme"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/comments"; nocase; http.request_body; content:"comment_html"; nocase; content:"javascript:"; nocase; sid:2026102982; rev:1; reference:cve,2026-102982; classtype:web-application-attack;)

Elastic Detection

sequence by user.name
  [process where event.action == "comment_created" and process.args : "*comment_html*"]
  [network where event.category == "network" and url.full : ("javascript:*" or "data:*" or "vbscript:*")]

Splunk SPL Query

index=web sourcetype=plane:access
| search uri_path="*/comments*" method=POST
| eval payload=coalesce(request_body, body)
| where like(payload, "%comment_html%") AND (like(payload, "%javascript:%") OR like(payload, "%data:%") OR like(payload, "%vbscript:%"))
| table _time, src_ip, user, uri_path, payload
| sort - _time

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-102982,">
  <rule id="202610982" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri">/comments</field>
    <field name="method">POST</field>
    <match>comment_html</match>
    <regex type="pcre2">javascript:|data:text/html|vbscript:</regex>
    <description>CVE-2026-102982: Plane comment with unsafe URL scheme (possible stored XSS)</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No patch commit or vendor-fix reference is available in the provided data; the only actionable statement is that the issue is fixed in version 1.4.0.

1. Immediate mitigations:

• Upgrade Plane to version 1.4.0 or later as the primary remediation (the description states the issue is fixed in 1.4.0).
• Where upgrade is not immediately possible, restrict comment authorship to trusted members and monitor comments for unsafe URL schemes (javascript:, data:, vbscript:).
• Deploy the detection rules above to log and alert on comments containing unsafe URL schemes.
• Consider a reverse-proxy/WAF rule to block comment payloads containing unsafe URL schemes.

2. Patch/upgrade steps:

• Verify the running Plane version.
• Back up the database (including comments/comment_html content) before upgrade.
• Upgrade to Plane 1.4.0 or later per the project's documented upgrade procedure.
• Re-validate that comments no longer render unsafe URL schemes as executable links.

3. Long-term hardening:

• Enforce server-side allowlisting of URL schemes (e.g., http, https, mailto) for all user-supplied links.
• Apply context-aware output encoding and a vetted HTML sanitization library to comment_html on input and render.
• Adopt a Content Security Policy that mitigates inline/dangerous-scheme script execution.
• Add regression tests that verify unsafe URL schemes cannot be stored or rendered in comments.

References

• NVD — CVE-2026-102982: https://nvd.nist.gov/vuln/detail/CVE-2026-102982
• Plane project (open-source project management tool) — release notes for version 1.4.0 (upgrade target)
• MITRE ATT&CK T1204.001 — User Execution: Malicious Link: https://attack.mitre.org/techniques/T1204/001/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: No KEV entry associated with CVE-2026-102982 as of this report; no exploit-in-the-wild evidence or named threat actor campaign is available in the provided data.