EUVD-2026-42915
GHSA-hff6-mprw-27h7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Agrees with vendor vector: network-accessible stored XSS requiring low-privilege injection and active user interaction to trigger, with confidentiality-only limited impact and no scope change.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
AnalysisAI
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. No public exploit or active exploitation has been identified; the CVSS score of 3.5 (Low) reflects the constrained impact due to required authentication, mandatory user interaction, and limited confidentiality-only impact.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored/persistent variant. YouTrack is JetBrains' collaborative issue tracking and project management platform used across software development teams. The flaw resides in how YouTrack processes user-supplied article titles when assembling digest emails: content is stored server-side without adequate sanitization and later embedded into email bodies without proper output encoding. When recipients render the HTML email, injected scripts execute in their browser context. The CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* indicates all versions prior to 2026.2.17394 are within scope.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.17394 or later, which resolves the stored XSS per the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If an immediate upgrade is not feasible, consider disabling digest email delivery as a compensating control - this eliminates the delivery mechanism for the payload but reduces platform utility for teams relying on email summaries. As an additional layer, restricting article creation and editing permissions to trusted users only reduces the injection surface, since exploitation requires at minimum a low-privileged account able to set article titles. Configuring email clients to block active HTML content or external resources in emails provides marginal secondary defense but affects all HTML email rendering broadly.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today