medium5.4
CVE-2026-10850
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the A…
Impact
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Plane | Plane | Version 1.3.1 |