EUVD-2026-72500
GHSA-gxp9-r2wc-vvv8
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Low-privilege authenticated user injects payload; victim must view it (UI:R); impact confined to session/DOM within YouTrack origin with no availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
AnalysisAI
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active YouTrack account with sufficient permissions to set or modify issue assignee names (low-privilege authenticated access, PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N and score of 4.6 (Medium) accurately characterize the realistic risk profile: low complexity once authenticated, but gated by the requirement for a low-privilege account and a separate victim to view the poisoned assignee name. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.18634 or any later release, which resolves the AngularJS template injection in assignee name rendering. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today