CVE-2026-104979

HighCVSS 8.7/10Last modified Oct 5, 2026

Description

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1049824.3A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the CVE-2026-1049836.3A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of CVE-2026-1049888.1A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is subm CVE-2026-1049917.1Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comme CVE-2026-1049936.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2026-1049942.5Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The CVE-2026-1049958.1The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_templat CVE-2026-10507.3A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/j CVE-2026-1050037.8Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.CVE-2026-1050047.8Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.CVE-2026-1050058.1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.CVE-2026-1050066.4Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.