CVE-2026-104979

Executive Summary

CVE-2026-104979 is a stored cross-site scripting (XSS) vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. The flaw resides in IntakeIssuePublicViewSet.create, which writes description_html without invoking the validate_html_content sanitization routine from the nh3 library. Any authenticated user—even one with no workspace memberships—can inject malicious HTML into a project that has a published DeployBoard with intake enabled, leading to JavaScript execution in the session of a project member or viewer who clicks the planted link. This allows exfiltration of a long-lived API token, resulting in high confidentiality and integrity impact.

Technical Analysis

The vulnerability is a classic stored XSS (CWE-79) arising from improper input neutralization. Specifically, the IntakeIssuePublicViewSet.create method in Plane v1.3.1 uses Issue.objects.create(...) to persist user-supplied description_html directly into the database without calling validate_html_content from the nh3 HTML sanitization library. This omission allows arbitrary HTML, including <script> tags or event handlers, to be stored and later rendered in the context of other users' browsers.

The attack surface is exposed through the intake feature of a published DeployBoard. An authenticated attacker—even one without workspace membership—can submit an issue via the intake form, planting malicious HTML. When a project member or viewer opens the closed intake item and clicks the planted link, two client-side weaknesses are chained: a TipTap parser bypass for \tjavascript: URIs and a target="_self" click handler. These enable JavaScript execution in the victim's session, which can then exfiltrate a long-lived API token. The vulnerability requires user interaction (clicking the link), and the scope is changed (S:C) because the injected script can affect resources beyond the vulnerable component (e.g., the victim's session and API token).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, high confidentiality and integrity impact, and no availability impact. The EPSS score is not yet available, and no public proof-of-concept or exploit code has been observed. CISA KEV does not list this CVE.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies a Plane instance (version < 1.4.0) with a published DeployBoard and intake enabled. This can be done by browsing public projects or using Shodan dorks such as http.html:"Plane" to locate exposed instances.

2. Triggering the flaw: The attacker authenticates to the Plane instance—any account suffices, even one with no workspace memberships. They navigate to the intake form of a project with a published DeployBoard and submit a new issue. In the issue description field, they inject malicious HTML that exploits the missing validate_html_content call, planting a link containing a javascript: URI obfuscated with a tab character (\tjavascript:) to bypass the TipTap parser.

3. Payload/execution method: The malicious HTML is stored via Issue.objects.create(...) without sanitization. When a project member or viewer later views the closed intake item and clicks the planted link, the TipTap parser bypass allows the javascript: URI to execute. The target="_self" click handler ensures the script runs in the context of the current page, executing JavaScript in the victim's authenticated session. The script can then access and exfiltrate a long-lived API token stored in the session or accessible via the DOM.

4. Post-exploitation impact: With the exfiltrated API token, the attacker can perform actions on behalf of the victim, potentially leading to further compromise of the Plane instance, data theft, or lateral movement within the organization. The high confidentiality and integrity impact reflects the ability to read sensitive data and modify resources using the stolen token.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's session, leading to theft of a long-lived API token. This token can be used to impersonate the victim, access project data, modify issues, and potentially escalate privileges within the Plane instance. The CVSS score of 8.7 (High) with high confidentiality and integrity impact underscores the severity. The blast radius includes any user who interacts with the malicious issue, and the changed scope indicates that the vulnerability can affect resources beyond the vulnerable component (e.g., the victim's session and API token). Business impact includes data breach, unauthorized access to project management data, and potential supply chain risks if the token grants access to integrated systems.

Detection Guidance

Sigma Rule

title: Plane Intake XSS - Suspicious HTML in Issue Description
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects submission of issue descriptions containing javascript: URIs or script tags in Plane intake forms.
author: Threat Intelligence
date: 2026-05-12
logsource:
  category: web
  product: plane
detection:
  selection:
    http.method: 'POST'
    http.url|contains: '/intake/'
    http.request.body|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection
falsepositives:
  - Legitimate use of code snippets in issue descriptions
level: high
tags:
  - attack.t1189
  - cve.2026.104979

YARA Rule

rule CVE_2026_104979_Plane_XSS
{
    meta:
        description = "Detects malicious HTML payloads targeting Plane intake XSS (CVE-2026-104979)"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104979"
        severity = "high"
    strings:
        $s1 = "javascript:" ascii nocase
        $s2 = "<script" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "description_html" ascii nocase
    condition:
        any of ($s1, $s2, $s3, $s4) and $s5
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104979 Plane Intake XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/intake/"; http_uri; content:"description_html"; http_client_body; content:"javascript:"; http_client_body; nocase; content:"<script"; http_client_body; nocase; classtype:web-application-attack; sid:10000001; rev:1; reference:cve,2026-104979;)

Elastic Detection

sequence by host.id, user.id with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and url.path : "*/intake/*" and http.request.body : ("*javascript:*" or "*<script*" or "*onerror=*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*/intake/*" form_data="*javascript:*" OR form_data="*<script*" OR form_data="*onerror=*"
| stats count by src_ip, uri_path, form_data
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="http.url">/intake/</field>
    <field name="http.request.body">javascript:</field>
    <description>Possible Plane Intake XSS exploitation attempt (CVE-2026-104979)</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to Plane intake forms to trusted users only.
   • Disable intake on DeployBoards until patched.
   • Implement a Web Application Firewall (WAF) rule to block javascript: URIs and <script> tags in intake submissions.
   • Monitor logs for suspicious HTML payloads in issue descriptions.

2. Patch/upgrade steps:

   • No vendor patch is available. The issue is fixed in Plane v1.4.0, but no official patch has been released per tracked sources. Monitor the Plane GitHub repository for updates.
   • If a patch becomes available, upgrade to Plane 1.4.0 or later immediately.

3. Long-term hardening:

   • Ensure all user-supplied HTML is sanitized using libraries like nh3 before storage.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.
   • Conduct regular security audits of input handling and output encoding.
   • Educate users about phishing and social engineering risks.

References

• NVD - CVE-2026-104979
• Plane GitHub Repository
• Plane Release Notes v1.4.0 (if available)
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CISA Known Exploited Vulnerabilities Catalog (not listed)