JetBrains YouTrack EUVD-2026-39658

Exploitation requires the attacker to send attacker-controlled object data into the YouTrack websandbox bridge - i.e., the deployment must expose the sandboxed scripting/workflow/widget functionality that uses this bridge, and the attacker must supply a payload carrying prototype-polluting keys ('__proto__', 'constructor', 'prototype'). The vendor CVSS marks PR:N/UI:N (no authentication or user interaction in their scoring), but SSVC rates impact only 'partial' and the issue is tagged 'Information Disclosure,' so full unauthenticated compromise is not corroborated - authentication requirements are not independently confirmed from available data. Limiting factors: exploitation is bounded to instances before 2026.2.16593 that actually use/expose the websandbox bridge, SSVC reports the attack is not automatable, and EPSS/KEV signals indicate no observed in-the-wild use.

The signals here conflict and should temper the headline severity. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies trivial, unauthenticated, remote, full-impact compromise - yet CISA's SSVC framing reports Exploitation: none, Automatable: no, and Technical Impact: partial (not total), and the supplied tags label this 'Information Disclosure.' A 'partial' technical impact and an info-disclosure characterization are hard to reconcile with a C:H/I:H/A:H base score. EPSS is low (0.40%, 32nd percentile), there is no CISA KEV listing, and no public exploit was identified - consistent with the SSVC 'not automatable / no observed exploitation' read. Net: this is a real, patch-worthy flaw, but the 9.8 likely overstates real-world risk; low EPSS plus partial technical impact plus an info-disclosure tag points to limited or chained impact rather than turnkey RCE. CONFLICT TO VERIFY: vendor CVSS claims PR:N and full C/I/A impact while SSVC says partial impact and the tag says information disclosure - confirm the actual privilege requirement and impact ceiling with JetBrains before treating this as unauthenticated RCE.

An attacker who can submit input that reaches the YouTrack websandbox bridge - for example via a crafted workflow/widget payload or sandboxed-script interaction - sends an object containing '__proto__'/'constructor' keys that the bridge merges without sanitization. The polluted prototype then corrupts downstream object handling, enabling information disclosure across the sandbox boundary or altered application behavior. No public proof-of-concept has been identified, though the vendor's low attack complexity suggests the trigger itself is simple once the bridge is reachable.