CVE-2026-10850

🔶 medium

Summary

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.

CVSS Score

5.4

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-06-17

First Seen: 2026-06-25

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.8% of all 329,778 vulnerabilities in our database.

#254,666

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 17, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Oscar Naveda

SSVC data provided by CISA

Last Modified 2026-06-23

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-79

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
plane	plane	Affected	v1.3.1

🔗 References 2

https://fluidattacks.com/es/advisories/earth

Exploit Third Party Advisory

https://github.com/makeplane/plane

Product

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-46558	⚠️ high	8.3	0.2	Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization ...	2026-06-10
CVE-2026-40102	🔶 medium	6.5	0.0	Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-cont...	2026-05-20
CVE-2026-39843	⚠️ high	7.7	0.0	Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw ...	2026-04-09
CVE-2026-27949	ℹ️ low	2.0	0.0	Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentica...	2026-04-07
CVE-2026-30242	⚠️ high	8.5	0.0	Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/seri...	2026-03-06
CVE-2026-30244	⚠️ high	7.5	0.0	Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate work...	2026-03-06

These CVEs affect the same products