Stored XSS in JetBrains YouTrack via Mermaid and LaTeX

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in JetBrains YouTrack versions before 2026.2.19422. It allows malicious users to inject and execute arbitrary JavaScript code via Mermaid and LaTeX content, which is then stored on the server and rendered to other users.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on behalf of users, or deface the application. Users accessing affected content may have their data compromised or be redirected to malicious sites without their knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking breaches of security rules and patient privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.19422 or later to address the stored XSS vulnerability via Mermaid and LaTeX content.

Useful 0 Not Useful 0