EUVD-2026-42915
GHSA-hff6-mprw-27h7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Agrees with vendor vector: network-accessible stored XSS requiring low-privilege injection and active user interaction to trigger, with confidentiality-only limited impact and no scope change.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
AnalysisAI
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker holds at minimum a low-privileged YouTrack account with permissions to create or edit article titles (CVSS PR:L - unauthenticated external attackers cannot exploit this); (2) the YouTrack instance has digest email generation enabled and configured to include article titles in outbound emails; (3) one or more victims receive the digest and open it in an HTML-capable email client, then interact with the affected content (CVSS UI:R - passive delivery of the email alone does not trigger execution). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.5 (Low) score accurately characterizes the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged YouTrack user creates or edits an article with a title containing a crafted XSS payload. When YouTrack's digest email job runs and includes that article title in the outbound email, any recipient who opens the digest in an HTML-rendering email client and interacts with the content triggers the script in their browser, potentially exfiltrating their YouTrack session cookie to an attacker-controlled endpoint. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.17394 or later, which resolves the stored XSS per the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access th
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. Rated high severity (CVSS 8.8), this
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today