What is the CVSS score of CVE-2026-57926?

CVE-2026-57926 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of JetBrains YouTrack are affected by CVE-2026-57926?

JetBrains YouTrack contains a critical prototype pollution flaw (CVE-2026-57926, CVSS 9.8) affecting all versions before 2026.2.16593 that could enable unauthorized access to project data or system…. A patch is available.

How to fix or mitigate CVE-2026-57926?

Within 24 hours: Enumerate all YouTrack instances and document current versions across development, staging, and production environments. Within 7 days: Test YouTrack 2026.2.16593 or later in a non-production environment, verify integrations and plugins remain functional, and obtain change approval. Within 30 days: Deploy the patched version to all production YouTrack instances and confirm successful upgrades with post-deployment validation.

JetBrains YouTrack CVE-2026-57926

EUVD-2026-39658 CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-06-26 JetBrains

Information Disclosure Prototype Pollution Youtrack JetBrains

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

Vendor (JetBrains) PRIMARY

LOW

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.2 MEDIUM

Network-reachable bridge but exploitation needs a crafted prototype-polluting payload (AC:H) and access to sandbox features likely behind a login (PR:L); SSVC 'partial' impact and the info-disclosure tag justify C:L/I:L/A:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 27, 2026 - 18:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 27, 2026 - 18:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 27, 2026 - 18:52 vuln.today

cvss_changed

Severity Changed

Jun 27, 2026 - 18:52 NVD

LOW CRITICAL

CVSS changed

Jun 27, 2026 - 18:52 NVD

2.6 (LOW) 9.8 (CRITICAL)

Patch available

Jun 26, 2026 - 15:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:51 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

AnalysisAI

Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).

Technical ContextAI

YouTrack is JetBrains' web-based issue tracking and project-management server. Its 'websandbox' bridge is the boundary layer that brokers data and calls between sandboxed/client-side JavaScript (used for workflows, widgets, and embedded scripting) and the host environment. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - 'prototype pollution'): attacker-controlled keys such as '__proto__', 'constructor', or 'prototype' are merged into objects without sanitization, mutating the shared Object.prototype. Depending on how the polluted properties are later consumed, this can corrupt application logic, leak data across the sandbox boundary, or be chained toward code execution. The affected component is identified by CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, which encodes no version boundary itself.

RemediationAI

Vendor-released patch: 2026.2.16593 - upgrade JetBrains YouTrack to version 2026.2.16593 or later, which remediates the websandbox bridge prototype pollution; this is the primary and recommended fix. YouTrack Cloud instances are updated by JetBrains, while self-hosted operators must apply the upgrade themselves. No specific vendor workaround is published; as interim compensating controls for self-hosted deployments that cannot patch immediately, restrict network exposure of the instance (place it behind VPN/SSO and limit untrusted access), and tighten which accounts can author or import custom workflows and widgets that drive the websandbox - the trade-off is reduced extensibility and possible disruption to teams relying on custom scripting. Consult JetBrains' advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the authoritative fixed-version note.