JetBrains YouTrack CVE-2026-75048

The attacker must be able to submit content containing fenced code blocks to a YouTrack instance - typically via issue creation, comment submission, or wiki editing. The vendor CVSS assigns PR:N (no privileges required), implying anonymous content submission may be possible on some instances; however, many YouTrack deployments restrict issue creation to authenticated users, which would raise the effective prerequisite to a valid low-privileged account (PR:L). Exploitation is limited by the requirement that a victim must view the rendered content (UI:R) - the payload does not execute on submission, only on render. The scope change (S:C) means exploitation impacts the broader YouTrack application origin, not just a sandboxed context. Exploitation is further limited to instances running YouTrack before version 2026.2.18068; upgraded instances are not affected.

The CVSS 8.2 score reflects a genuine high-severity stored XSS: network-reachable (AV:N), low complexity (AC:L), no privileges explicitly required per vendor scoring (PR:N), requires one victim page-view (UI:R), and achieves a scope change with high confidentiality impact (C:H). The PR:N assignment warrants scrutiny - YouTrack deployments typically require authentication to create issues or comments, which would shift the realistic prerequisite to PR:L; security teams should verify whether their instance permits anonymous content submission before treating this as a fully unauthenticated vector. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public exploit code is identified at time of analysis. Despite the absence of active exploitation signals, the impact class (session hijack, account takeover via XSS in a developer tooling environment where CI/CD tokens and source access may be present) makes this a genuine priority for any team running an internet-exposed YouTrack instance. The patch version is clearly identified (2026.2.18068), making remediation straightforward.

An attacker with the ability to create or comment on YouTrack issues crafts a fenced code block whose language label contains a malicious JavaScript payload, such as a script that exfiltrates the victim's session cookie to an attacker-controlled server. The poisoned issue is saved to the YouTrack database and rendered to every subsequent viewer - a project manager reviewing a sprint, a CI bot, or a security team member triaging a report - causing the payload to silently execute in their browser context and transmit their session token. No public exploit code has been identified at time of analysis, but the technique is well-documented for Markdown-based stored XSS and requires no specialized tooling.