JetBrains YouTrack CVE-2026-100263

Exploitation requires that an attacker-controlled User-Agent header value be stored by YouTrack and later rendered to a victim in a context that interprets HTML. The limiting factor is user interaction (UI:R): a user - likely a privileged operator reviewing stored request/user-agent data - must view the affected page for the injected HTML to render. No authentication is required to plant the payload (PR:N), and it is remotely deliverable via a standard HTTP header (AV:N, AC:L), but impact is confined to Low confidentiality with a scope change; there is no integrity or availability impact and the flaw is HTML injection rather than confirmed full script execution. Affects JetBrains YouTrack versions before 2026.2.18991.

This is a genuinely low-priority issue despite being network-exploitable and unauthenticated. The CVSS 3.1 base score of 4.7 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) reflects stored HTML injection with limited impact: only confidentiality is affected and only at Low, with no integrity or availability impact. The scope change (S:C) and the fact that it is stored/persistent are the main aggravating factors - injected content executes in the context of a different security scope (e.g., a staff/admin viewing request logs or user-agent data). Crucially, exploitation requires user interaction (UI:R): a victim must view the page that renders the malicious User-Agent value. No EPSS score, KEV listing, or public exploit code is present in the provided data, so there is no public exploit identified at time of analysis. This is CWE-79 (injection) but described specifically as 'HTML injection' rather than full script execution, which further caps real-world impact. Net: a real but minor hardening fix, not an urgent patch. No conflicting signals were found in the input; the CVSS vector and the description are consistent (network-delivered header, victim views stored content).

An unauthenticated attacker sends an HTTP request to a YouTrack instance with a crafted User-Agent header containing HTML markup, which is stored by the application. Later, when a privileged user (e.g., an administrator reviewing request/session or user-agent information) views the page that renders that stored value, the injected HTML is interpreted in the victim's browser context. No public exploit code is identified at time of analysis, and success depends on the victim opening the affected view (UI:R).