JetBrains YouTrack EUVD-2026-42909

Exploitation requires an authenticated YouTrack account with at minimum low-privilege access sufficient to create or edit content that supports Mermaid diagram rendering - such as issues, comments, or wiki pages. A second user (the victim) must actively navigate to and render the page containing the injected content (UI:R). Unauthenticated external attackers cannot exploit this vulnerability directly. Exploitation is further bounded by the unchanged scope (S:U), meaning impact is confined to the victim's YouTrack browser session with no lateral movement to other systems. No non-default configuration is required; any YouTrack deployment with Mermaid rendering enabled and accessible to low-privilege users is in scope. The limiting factors - mandatory authentication and required victim interaction - are the primary reasons real-world exploitation risk is low despite network accessibility.

The official CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N and score of 3.5 (Low) accurately characterize this as a constrained-impact vulnerability. Two hard gates - an authenticated low-privilege account (PR:L) and victim user interaction (UI:R) - must both be satisfied for exploitation. No EPSS data was provided; however, the combination of low CVSS, integrity-only impact (I:L, C:N, A:N), unchanged scope (S:U), absence of KEV listing, and no known public exploit code collectively point to low immediate operational priority. The primary threat model is intra-platform abuse: a malicious insider or compromised account manipulates the visual interface for phishing or clickjacking other users within the same YouTrack instance. Public-facing YouTrack deployments that permit broad self-registration or low-trust authenticated access carry marginally higher risk than tightly controlled internal instances. No data conflicts between available signals were identified.

An authenticated YouTrack user with low privileges creates an issue or wiki page embedding a Mermaid diagram block containing injected CSS that overlays a fake login prompt or spoofs a UI element. When a project member or administrator opens the page, the malicious styles render in their browser, potentially tricking them into submitting credentials or clicking a misleading interface element. No public proof-of-concept code is known at time of analysis.