JetBrains YouTrack CVE-2026-86483

The attacker must hold a YouTrack account with at least project-member level access that permits setting or editing custom field values on Agile board cards - this is the primary limiting condition. The custom field type involved must render user-supplied HTML or JavaScript without sanitization in the Agile board card view. Exploitation also requires that a victim with an active authenticated session view the Agile board containing the malicious card (UI:R). Factors that limit exploitation: unauthenticated external attackers cannot exploit this vulnerability; the attacker must be a project participant; the victim must actively navigate to the affected board view rather than being reachable passively. YouTrack on-premises instances not accessible from the internet are further protected by network segmentation.

The provided CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately reflects the risk profile. Real-world exploitability is constrained by two factors: the attacker must hold at least low-level project membership (PR:L) to set custom field values, and a target victim must actively navigate to the Agile board displaying the malicious card (UI:R). Despite these prerequisites, stored XSS is inherently persistent and opportunistic - once planted, the payload executes for every subsequent visitor. In development team environments where Agile boards are reviewed frequently by leads, managers, and other developers, dwell time before triggering can be very short. No KEV listing and no public exploit code reduce urgency for immediate emergency patching, but the low attack complexity once prerequisites are met warrants prompt remediation. The confidentiality and integrity impacts are both Low individually, but chained XSS attacks enabling session token exfiltration could lead to full account compromise beyond what the base CVSS conveys.

An attacker with project-member access to a YouTrack instance crafts a malicious JavaScript payload and injects it into a custom field value on an Agile board card - for example, embedding a script tag or event handler in a text-type custom field. When a project lead or scrum master opens the Agile board to review sprint progress, their browser silently executes the stored payload, exfiltrating their session cookie to an attacker-controlled server and granting the attacker full access to the victim's YouTrack account. No public exploit code has been identified at time of analysis, but the technique is well understood and requires no specialized tooling.