EUVD-2026-60247
GHSA-whvx-752g-wvrx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
PR:L reflects that most YouTrack deployments require a valid account to submit issues; all other vendor metrics are retained as consistent with stored XSS scope-change impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
AnalysisAI
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to submit content containing fenced code blocks to a YouTrack instance - typically via issue creation, comment submission, or wiki editing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects a genuine high-severity stored XSS: network-reachable (AV:N), low complexity (AC:L), no privileges explicitly required per vendor scoring (PR:N), requires one victim page-view (UI:R), and achieves a scope change with high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to create or comment on YouTrack issues crafts a fenced code block whose language label contains a malicious JavaScript payload, such as a script that exfiltrates the victim's session cookie to an attacker-controlled server. The poisoned issue is saved to the YouTrack database and rendered to every subsequent viewer - a project manager reviewing a sprint, a CI bot, or a security team member triaging a report - causing the payload to silently execute in their browser context and transmit their session token. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.18068 or later, which is the vendor-confirmed patched release per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict issue and comment creation to trusted team members and administrators; send urgent user notification to avoid interacting with suspicious content in issues and comments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today