Stored XSS in JetBrains YouTrack

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in JetBrains YouTrack before version 2026.2.18068. It allows attackers to inject malicious scripts via the fenced code-block language label, which are then stored on the server and executed when other users view the affected content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored XSS via fenced code-block language labels in JetBrains YouTrack before 2026.2.18068. To detect it, inspect YouTrack instances for user-generated content containing suspicious JavaScript in code-block language labels. Check server logs for unusual script execution patterns or unauthorized actions. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to steal sensitive user data, perform actions on behalf of users, or deface web pages. Users interacting with the compromised content may unknowingly execute malicious scripts, leading to potential account takeovers or unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.18068 or later to address the stored XSS vulnerability.

Useful 0 Not Useful 0