EUVD-2026-42909
GHSA-mpf8-m2c9-vcf7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Requires low-privilege authenticated account to inject CSS via Mermaid and victim to view it; impact is UI integrity only with no confidentiality or availability consequences.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
AnalysisAI
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
JetBrains YouTrack is a project management and issue tracking platform that natively supports Mermaid diagram rendering within issues, wiki pages, and comments. Mermaid is a JavaScript-based diagramming library that parses lightweight text syntax into rendered SVG/HTML diagrams. When user-supplied Mermaid input is not adequately sanitized prior to rendering, arbitrary CSS declarations can be injected into the page's style context. The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), which encompasses scenarios where injected visual content manipulates interface presentation - enabling UI overlay attacks, content spoofing, or CSS-based side-channel exfiltration. All YouTrack versions are affected per CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, with the fix landing in 2026.2.17012.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.17012 or later, which resolves the CSS injection via Mermaid diagram rendering. Details are available in the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If an immediate upgrade is not operationally feasible, consider restricting Mermaid diagram creation permissions to trusted user roles only, accepting the trade-off of reduced diagramming functionality for lower-trust accounts. Additionally, reviewing and tightening the instance's Content Security Policy (CSP) headers to disallow inline style injection can reduce the impact surface, though this is a compensating control rather than a fix and may affect other rendering features. No other workarounds are confirmed by vendor data.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Share
External POC / Exploit Code
Leaving vuln.today