CVE-2026-104979

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description An issue exists where the IntakeIssuePublicViewSet.create function writes description html via Issue.objects.create() without utilizing the validate html content function from the nh3 library. This allows any authenticated user, including those without workspace memberships, to inject arbitrary HTML into projects with a published DeployBoard and enabled intake. When a project member or viewer interacts with a closed intake item by clicking a planted link, a parser bypass in TipTap involving javascript: and a target=" self" click handler executes JavaScript within the viewer's session to exfiltrate a long-lived API token.

Recommendations Update to version 1.4.0.