Is CVE-2026-102982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102982 being exploited in the wild.

How severe is CVE-2026-102982?

Informational severity, published 13 October 2026.

Is there a fix for CVE-2026-102982?

Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102982 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102982?

Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102982: Plane stored XSS in comments and intake descriptions

CVE-2026-102982 · Severity: info · Published 2026-10-13

Plane is an open-source project management tool where comments and issue descriptions can store rich HTML. Prior to version 1.4.0, these fields did not properly sanitize user input, allowing a project member to inject malicious JavaScript that executes in other users' browsers when they view the comment or description.

Technologies: Plane. Vendors: Plane.

Quick answers

Is CVE-2026-102982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102982 being exploited in the wild.
How severe is CVE-2026-102982?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Plane before 1.4.0.
Is there a fix for CVE-2026-102982?: Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102982 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102982?: Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.0

Technical details

Stored XSS vulnerability in IssueCommentSerializer (both app and API layers) and intake description endpoints. The comment_html and description_html fields were either not validated or only underwent structural normalization without XSS payload removal. An authenticated project member can craft and submit a comment or intake issue with JavaScript payloads (e.g., script tags or javascript: URIs) that persist and execute in victims' browser contexts. Fixed in version 1.4.0 by adding validate_html_content() sanitization using the nh3 HTML sanitizer.

Affected products

Plane Plane before 1.4.0

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.