CVE-2026-10850: Plane CE 1.3.1 XSS Vulnerability

CVE-2026-10850 Overview

CVE-2026-10850 is a stored cross-site scripting (XSS) vulnerability in Plane CE 1.3.1, an open-source project management platform. The flaw allows a low-privileged project member to submit arbitrary HTML and JavaScript through the description_html field when creating an intake work item via the API v1 intake endpoint. The injected payload executes in the browser context of any user who later views the affected work item. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers with project-member privileges can plant persistent JavaScript that runs in higher-privileged users' sessions, enabling session theft, UI manipulation, and lateral access within the Plane workspace.

Affected Products

Plane CE 1.3.1
Plane CE API v1 intake endpoint
Self-hosted Plane deployments exposing the intake workflow

Discovery Timeline

2026-06-17 - CVE-2026-10850 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10850

Vulnerability Analysis

The vulnerability resides in the API v1 intake endpoint of Plane CE 1.3.1. The endpoint accepts a description_html parameter intended to hold rich-text content for intake work items. The server stores the supplied HTML without neutralizing executable markup such as <script> tags or event-handler attributes. When the work item is rendered in the Plane web client, the unsanitized HTML is inserted into the Document Object Model (DOM) and the embedded JavaScript executes.

The attack is persistent because the payload is stored in the backend database. Every project member who opens the intake item triggers the script in their own authenticated session. The vulnerability requires only a low-privileged project membership (PR:L) and user interaction (UI:P) when the victim views the item. The attack vector is network-based, confined to a single application, and primarily affects confidentiality of the targeted user session.

Root Cause

The root cause is missing or insufficient HTML sanitization on the server side when handling the description_html field. The intake API trusts client-supplied markup and persists it verbatim. The web client subsequently renders the field as HTML rather than escaped text, completing the injection chain.

Attack Vector

An authenticated attacker holding any project-member role sends a crafted POST request to the API v1 intake endpoint. The JSON body includes a description_html value containing a payload such as a <script> tag or an <img onerror=...> construct. Once a project lead or administrator opens the intake queue and views the malicious item, the script executes with the victim's session cookies and CSRF context. Refer to the Fluid Attacks Security Advisory and the Plane GitHub Project Repository for upstream technical details.

Detection Methods for CVE-2026-10850

Indicators of Compromise

Intake work items whose description_html field contains <script>, onerror=, onload=, javascript:, or base64-encoded payloads inside HTML attributes.
API v1 intake POST requests originating from low-privileged accounts that contain unusually large or markup-heavy description_html payloads.
Outbound browser requests to unfamiliar domains immediately after a Plane user opens the intake view.

Detection Strategies

Inspect application logs for POST requests to the intake endpoint and flag payloads matching common XSS patterns in description_html.
Run a database query across stored intake items to identify HTML containing script tags or inline event handlers.
Correlate web proxy telemetry with Plane user sessions to spot script-initiated requests to external hosts following intake page loads.

Monitoring Recommendations

Enable verbose request logging on the Plane API and forward logs to a centralized analytics platform for pattern matching.
Monitor browser Content Security Policy (CSP) violation reports for the Plane domain to surface blocked inline scripts.
Alert on session anomalies for privileged Plane accounts, including new IP addresses or token reuse soon after viewing intake content.

How to Mitigate CVE-2026-10850

Immediate Actions Required

Restrict access to the intake endpoint to trusted accounts until a fixed release of Plane CE is deployed.
Audit existing intake work items for stored HTML payloads and quarantine or sanitize any items containing executable markup.
Rotate session tokens and API keys for project leads and administrators who may have viewed untrusted intake items.

Patch Information

No vendor-supplied patch is referenced in the CVE record at the time of publication. Monitor the Plane GitHub Project Repository for releases newer than 1.3.1 that address the description_html sanitization gap, and review the Fluid Attacks Security Advisory for the latest remediation guidance.

Workarounds

Deploy a strict Content Security Policy that disables inline scripts and limits script sources to trusted origins for the Plane web client.
Place the Plane application behind a web application firewall (WAF) rule that rejects intake API requests containing <script> tags or inline event handlers in description_html.
Limit project-member roles to verified users and disable self-service intake submission for anonymous or external contributors.

bash

# Example WAF rule (ModSecurity) blocking script tags in description_html
SecRule REQUEST_URI "@beginsWith /api/v1/" \
  "chain,phase:2,deny,status:400,id:1026108501,msg:'Blocked XSS in Plane intake description_html'"
  SecRule REQUEST_BODY "@rx (?i)description_html.*(<script|on[a-z]+\s*=|javascript:)" \
    "t:none,t:urlDecodeUni"