Stored XSS in JetBrains YouTrack via Agile Board Cards

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in JetBrains YouTrack before version 2026.2.18634. It allows an attacker to inject malicious scripts via a custom field on Agile board cards, which are then stored on the server and executed when other users view the affected cards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored XSS via custom fields on Agile board cards in JetBrains YouTrack. Detection requires checking for malicious scripts in custom field values on Agile board cards. Manually inspect custom field inputs for unusual or executable content. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary JavaScript in the context of other users' browsers when they view the affected Agile board cards. This may lead to session hijacking, data theft, or unauthorized actions performed on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows stored XSS via custom fields on Agile board cards, which could lead to unauthorized data access or manipulation. This may impact compliance with GDPR by risking data integrity and confidentiality, and with HIPAA by potentially exposing protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.18634 or later to address the stored XSS vulnerability via custom fields on Agile board cards.

Useful 0 Not Useful 0