What is the CVSS score of CVE-2026-33392?

CVE-2026-33392 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ssti are affected by CVE-2026-33392?

CVE-2026-33392 affects JetBrains YouTrack and allows authenticated administrators to execute arbitrary code on the server by bypassing sandbox protections through server-side template injection.. A patch is available.

How to fix or mitigate CVE-2026-33392?

Within 24 hours: identify all YouTrack instances and document current versions; restrict administrative access to YouTrack to essential personnel only and enforce multi-factor authentication on all admin accounts. Within 7 days: implement network segmentation to isolate YouTrack from critical infrastructure; disable or restrict server-side template functionality if configuration options exist; conduct access review of all admin accounts created or modified in the past 90 days. Within 30 days: monitor JetBrains security advisories daily for patch availability for versions before 2025.3.131383; develop contingency plan for YouTrack replacement or air-gapping if patch timeline extends beyond acceptable risk window; perform audit logs review for suspicious administrative activity.

Ssti CVE-2026-33392

EUVD-2026-23386 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-04-17 JetBrains

Authentication Bypass Ssti

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 20:18 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Patch available

Apr 17, 2026 - 09:01 EUVD

Analysis Generated

Apr 17, 2026 - 08:22 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 08:15 euvd

EUVD-2026-23386

Analysis Generated

Apr 17, 2026 - 08:15 vuln.today

CVE Published

Apr 17, 2026 - 07:46 nvd

HIGH 7.2

DescriptionCVE.org

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

AnalysisAI

Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.

Technical ContextAI

YouTrack is JetBrains' issue tracking and project management platform deployed in enterprise environments. The vulnerability is rooted in CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), indicating a server-side template injection flaw. The sandbox bypass mechanism suggests that YouTrack implements a security sandbox (likely for workflow scripts, custom fields, or issue templates) that can be circumvented by authenticated administrators. SSTI vulnerabilities typically occur when user-controlled input is embedded into template engines (such as Velocity, FreeMarker, or proprietary template systems) without proper sanitization, allowing template directives to execute arbitrary code. The CPE identifier cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* confirms this affects the YouTrack application platform broadly across deployment configurations.

RemediationAI

Upgrade JetBrains YouTrack to version 2025.3.131383 or later, which contains the vendor-released patch for this sandbox bypass vulnerability. Download the patched version from JetBrains' official distribution channels and follow standard YouTrack upgrade procedures documented at https://www.jetbrains.com/privacy-security/issues-fixed/. For environments unable to immediately upgrade, implement compensating controls: conduct immediate audit of all accounts with administrative privileges and reduce admin role assignments to minimum necessary personnel using principle of least privilege; enable comprehensive audit logging for all administrative actions including workflow modifications, custom field changes, and template edits; implement network segmentation to isolate YouTrack instances from critical infrastructure; monitor for unusual administrative activity patterns such as unexpected workflow script modifications or template changes. Note that compensating controls only reduce attack surface and do not eliminate the vulnerability-administrative users in the trusted subset retain exploitation capability. Organizations should prioritize patching over mitigations given the total technical impact potential.