CVE-2025-55203: Plane Project Management XSS Vulnerability

CVE-2025-55203 Overview

CVE-2025-55203 is a stored cross-site scripting (XSS) vulnerability in Plane, an open-source project management platform. The flaw exists in the description_html field, which fails to properly sanitize or escape user-supplied input. Attackers with authenticated access can inject malicious JavaScript payloads that persist in the application database. When other users view the affected content, the injected script executes in their browser under the application's origin.

The vulnerability affects Plane versions prior to 0.28.0 and has been patched in version 0.28.0. Exploitation can lead to session hijacking, theft of sensitive data, or forced redirection to attacker-controlled sites.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential exposure, and CSRF chaining within the Plane application context.

Affected Products

Plane (makeplane/plane) versions prior to 0.28.0
Self-hosted Plane deployments running vulnerable releases
Any Plane instance exposing the description_html field to multi-user collaboration

Discovery Timeline

2025-08-15 - CVE-2025-55203 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55203

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. Plane accepts rich HTML content through the description_html field used across issues, projects, and related entities. The application stores this content without applying adequate sanitization or output encoding.

When another authenticated user renders the affected view, the browser parses the stored HTML and executes any embedded script. Because the payload runs in the Plane origin, it inherits the victim's session context and can invoke authenticated API endpoints. The stored nature of the flaw means a single injection can affect every user who views the compromised record.

Root Cause

The root cause is missing server-side sanitization and improper output encoding of the description_html field. The application trusts submitted HTML markup and returns it to viewers without stripping active content such as <script> tags, event handlers, or JavaScript URIs. Version 0.28.0 introduces proper sanitization to remediate this behavior.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit records containing a description. The attacker submits a crafted payload in the description_html field. When a second user opens the affected issue, project, or comment, the payload executes in their browser session.

Successful exploitation enables session hijacking, exfiltration of authentication tokens, forced navigation to malicious sites, and chaining with cross-site request forgery to perform unauthorized state-changing actions. Attackers can also stage secondary browser exploits or malware distribution. Refer to the GitHub Security Advisory GHSA-rwjc-xhh3-m9m9 for the vendor's technical description.

Detection Methods for CVE-2025-55203

Indicators of Compromise

Presence of <script> tags, on* event handlers, or javascript: URIs within stored description_html values in the Plane database.
Outbound browser requests from authenticated Plane sessions to unfamiliar domains immediately after loading an issue or project view.
Unexpected API calls originating from user sessions shortly after viewing a specific record, indicating potential CSRF chaining.

Detection Strategies

Query the Plane database for records where description_html contains suspicious HTML constructs such as <script, onerror=, onload=, or javascript:.
Review web server and application logs for POST or PATCH requests to description endpoints containing script-like payloads.
Compare content revisions to identify accounts that introduced HTML content deviating from typical rich-text usage.

Monitoring Recommendations

Enable browser Content Security Policy (CSP) violation reporting to surface script executions blocked by policy.
Monitor authentication logs for concurrent sessions or token reuse from unexpected IP addresses following viewing activity.
Alert on new outbound domains contacted by users interacting with Plane during normal business workflows.

How to Mitigate CVE-2025-55203

Immediate Actions Required

Upgrade all Plane instances to version 0.28.0 or later without delay.
Audit existing description_html content for stored payloads introduced before the upgrade and remove or sanitize affected records.
Rotate session tokens and API keys for accounts that may have viewed malicious content.

Patch Information

The maintainers of Plane released version 0.28.0, which introduces proper sanitization and escaping for the description_html field. Administrators should upgrade using the vendor's release procedures documented in the GitHub Security Advisory GHSA-rwjc-xhh3-m9m9.

Workarounds

Restrict edit permissions on descriptions to trusted users until the upgrade is complete.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted origins.
Place Plane behind a web application firewall configured to block HTML injection patterns in description fields.

bash

# Example Content-Security-Policy header for Plane reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;