CVE-2026-104979

8.7 HIGHpublic exploit available

Published 2026-10-05 · Updated 2026-10-05

AI risk analysis

Summary: The flaw allows any authenticated user to inject arbitrary HTML, leading to potential JavaScript execution and API token exfiltration when clicked by a project member or viewer.
Exploitability: Exploitation is relatively easy as it requires an authenticated user to plant a link in a project, and the target must click it. Precondition is that the project has a published DeployBoard with intake enabled.
Blast radius: If exploited, the impact is high as it can lead to full API token exfiltration, potentially compromising the entire project and its members.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Plane 1.4.0 or later.

rcewebhtml-injectionapi-exfiltration

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-79, CWE-862

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.