CVE-2026-10850: Stored XSS in Plane CE 1.3.1 Intake API – Analysis & Patch Guidance

Technical summary

CVE-2026-10850 is a stored XSS vulnerability (CWE-79) affecting Plane CE 1.3.1's API v1 intake endpoint. The vulnerability exists because the `description_html` parameter accepts unsanitized user input when creating intake work items. An authenticated low-privileged user can submit arbitrary HTML and JavaScript, which is persisted in the database without proper encoding or validation. When other users retrieve and display the work item in the web interface, the malicious script executes in their browser context with their privileges, enabling session hijacking, data exfiltration, or further compromise.

Business impact

This vulnerability creates operational and security risk for organizations using Plane CE for project management. If exploited, attackers with minimal project access could compromise the integrity of work items and potentially escalate access by hijacking administrator sessions. The persistence of the malicious payload means the attack affects multiple users over time without requiring repeated exploitation attempts. Teams relying on Plane CE for sensitive project data or compliance workflows face exposure of information through XSS-based exfiltration.

Affected systems

Plane Community Edition (CE) version 1.3.1 is confirmed vulnerable. Organizations running this specific version with publicly accessible or internally exposed instances are at risk, particularly if they have contractor, vendor, or multi-team access models where low-privileged users are provisioned. Verify your Plane CE version in the system administration settings or by checking the release notes of your deployment.

Exploitability

Exploitation requires valid authentication and project membership, which raises the barrier compared to unauthenticated attacks. However, the requirement is only low-privilege access—standard contributors to a project can exploit this. The attack is reliable once an attacker has user credentials or can socially engineer access, as input validation is absent. No user interaction from the attacker is required beyond submitting the malicious payload; the victim's interaction with the stored item triggers the XSS. Network accessibility is straightforward (AV:N). Overall, this is a practical post-authentication vulnerability with meaningful real-world risk in environments with permissive user provisioning.

Remediation

Upgrade Plane CE to a patched version released after 2026-06-23 that sanitizes and validates the `description_html` field on API intake endpoints. If immediate patching is not feasible, restrict API access to trusted users and implement API-level input validation or WAF rules that strip or escape HTML tags in intake creation requests. Consider disabling the public API intake endpoint if it is not operationally necessary.

Patch guidance

Check the official Plane project repository and release notes for versions after June 23, 2026. Patches should include HTML sanitization in the intake endpoint's description field processing. When patching, test intake work item creation across the API and web interface to ensure the fix does not break legitimate formatting or attachments. Recommend upgrading to the latest Plane CE stable release.

Detection guidance

Monitor API access logs for POST requests to the v1 intake endpoint with unusually large or HTML-tag-containing payloads in the `description_html` parameter. Review stored intake work items for suspicious script tags, iframe elements, or event handlers in description fields. Deploy Web Application Firewall rules to flag or block HTTP requests containing script tags in POST body parameters targeting the intake endpoint. Query your Plane database for work items containing patterns like `<script>`, `onerror=`, or `javascript:` in the description_html field to identify potentially malicious items already created.

Why prioritize this

Although listed as MEDIUM severity and not yet on CISA's KEV catalog, this vulnerability merits prompt attention because: (1) it affects a widely-used open-source project management tool with multi-tenant and contractor use cases; (2) stored XSS bypasses some perimeter defenses and affects multiple users passively; (3) exploitation is reliable with minimal privilege; (4) session hijacking and lateral movement become possible if administrators are compromised. Organizations with contractor or vendor access to Plane should prioritize patching before those with purely internal teams.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for authenticated access (PR:L) and user interaction by the victim (UI:R), which reduce the base score. However, the impact scope is changed (S:C), indicating cross-account or organizational-level concern. Confidentiality and integrity are impacted (C:L, I:L) through session hijacking and data manipulation, but availability is not affected. The moderate score should not diminish urgency in environments where low-privilege users are frequently provisioned or where project data is sensitive.

Frequently asked questions