Plane stores comment markup in a field called comment_html without sanitizing unsafe URL schemes. A member of a project can embed a malicious link in a comment and, when another user selects that link, the browser loads and executes the embedded script. The effect is the execution of arbitrary client‑side code in the context of the second user, which can lead to theft of session identifiers, credential leakage, or further manipulation of the application from the victim’s browser.

The vulnerability affects deployments of the open‑source Plane project management tool from the vendor makeplane:plane. All versions before 1.4.0 are vulnerable. Updating to 1.4.0 or later removes the missing sanitization and eliminates the attack surface.

The CVSS score of 8.5 reflects high severity. EPSS data are not available, but the vulnerability is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation has not yet been reported. Attackers only need project member access to create the malicious comment, making the risk significant for teams that allow user comments.