EUVD-2026-42909
GHSA-mpf8-m2c9-vcf7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Requires low-privilege authenticated account to inject CSS via Mermaid and victim to view it; impact is UI integrity only with no confidentiality or availability consequences.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
AnalysisAI
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated YouTrack account with at minimum low-privilege access sufficient to create or edit content that supports Mermaid diagram rendering - such as issues, comments, or wiki pages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N and score of 3.5 (Low) accurately characterize this as a constrained-impact vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated YouTrack user with low privileges creates an issue or wiki page embedding a Mermaid diagram block containing injected CSS that overlays a fake login prompt or spoofs a UI element. When a project member or administrator opens the page, the malicious styles render in their browser, potentially tricking them into submitting credentials or clicking a misleading interface element. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.17012 or later, which resolves the CSS injection via Mermaid diagram rendering. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access th
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. Rated high severity (CVSS 8.8), this
Share
External POC / Exploit Code
Leaving vuln.today