EUVD-2026-33416
GHSA-fq9q-7rvg-h4m2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
AnalysisAI
Stored cross-site scripting in JetBrains YouTrack versions prior to 2026.1.13162 allows an authenticated project-level user to inject persistent JavaScript into project notification templates, which executes in the browsers of other users who receive or view those notifications. The scope-changed CVSS 8.7 reflects that injected scripts can pivot beyond the vulnerable component to compromise the sessions and data of higher-privileged recipients. No public exploit identified at time of analysis and no KEV listing, but the issue was disclosed and patched directly by the vendor.
Technical ContextAI
YouTrack is JetBrains' issue tracking and project management platform, identified by CPE cpe:2.3:a:jetbrains:youtrack. The underlying weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant where user-supplied content placed into project notification templates is rendered without sufficient output encoding or sanitization. Notification templates are server-side artifacts rendered into HTML email or in-app notifications, so untrusted markup or script syntax injected at template-definition time is persisted and later evaluated in a recipient's authenticated browser context.
RemediationAI
Vendor-released patch: upgrade YouTrack to version 2026.1.13162 or later, as published on the JetBrains security advisory page at https://www.jetbrains.com/privacy-security/issues-fixed/; JetBrains InCloud tenants should already be on the fixed build. Until the upgrade is applied, compensating controls include restricting the project-administration and notification-template-editing permissions to a small set of trusted accounts (trade-off: project owners lose self-service template customization), auditing existing notification templates for unexpected HTML, script, or event-handler attributes and reverting them to known-good content, and enforcing a strict Content Security Policy at the reverse proxy that disallows inline script execution for the YouTrack origin (trade-off: may break legitimate custom UI extensions if any are deployed).
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today