Plane EUVD-2026-98817

Requires an authenticated account with project-member privileges (PR:L) able to create a comment, and the ability to inject a link using an unsafe URL scheme (e.g. javascript:) into the comment_html field, which prior to version 1.4.0 was not sanitized for unsafe schemes. Exploitation is NOT self-triggering: a second user must open the affected issue and actively select/click the malicious link (UI:P / user interaction) for the script to execute in their browser context. Limiting factors: attacker must already hold legitimate project membership on the target instance, the payload only fires against users who click the crafted link, and instances running 1.4.0 or later are not affected. No special non-default server configuration is required - any pre-1.4.0 Plane instance with multiple users sharing projects is exposed.

This is a genuine but conditional threat, not a drive-by critical. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N, base 8.5) describes a network-reachable, low-complexity stored XSS, but two metrics materially cap real-world risk: PR:L means the attacker must already be an authenticated project member (an insider or someone with a foothold on an existing account), and UI:P means a victim must actively select/click the crafted link before the attacker-controlled script fires. So exploitation is not fully 'unattended' - it depends on a human target interacting with poisoned comment content. No EPSS score is provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The strongest corroborating signal is the fix itself: the referenced PR #9287, commit 0d58adb, and the GHSA-6qrq-f73q-r67j advisory confirm the vulnerability is real and the root cause (failure to sanitize unsafe URL schemes such as javascript: in comment_html) is well understood. Net: treat this as a medium-priority patch for any multi-user Plane deployment - the VC:H/VI:H impact (session/account compromise in a victim's browser context) is serious, but the PR:L + UI:P prerequisites make it an insider/social-engineering vector rather than a mass-exploitable internet worm. Note the input provides no distinct POC or EPSS fields, so probability-of-exploitation cannot be quantified beyond the absence of KEV listing.

An authenticated project member posts a comment on an issue containing a link whose href uses an unsafe scheme (e.g. javascript:) that Plane stores in comment_html without sanitization. When a teammate viewing the issue clicks that link, the attacker's script runs in the victim's authenticated browser session, enabling session/token theft or actions performed as the victim. No standalone public exploit is identified, but the patch diff (PR #9287) publicly reveals the exact vulnerable sanitization path.