JetBrains YouTrack EUVD-2026-42915

Exploitation requires: (1) the attacker holds at minimum a low-privileged YouTrack account with permissions to create or edit article titles (CVSS PR:L - unauthenticated external attackers cannot exploit this); (2) the YouTrack instance has digest email generation enabled and configured to include article titles in outbound emails; (3) one or more victims receive the digest and open it in an HTML-capable email client, then interact with the affected content (CVSS UI:R - passive delivery of the email alone does not trigger execution). Limiting factors include: the authentication barrier preventing external exploitation, the user-interaction dependency reducing opportunistic mass exploitation, and the scope containment (S:U) preventing privilege escalation beyond the victim's browser session. Instances with digest emails disabled or restricted to plain-text rendering are not exploitable via this vector.

The CVSS 3.5 (Low) score accurately characterizes the constrained real-world risk. The vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N confirms network reachability but mandates both a low-privilege account (PR:L) and active victim interaction with the email (UI:R), with impact limited to partial confidentiality (C:L) and no integrity or availability degradation. No EPSS score, CISA KEV listing, or public POC was provided in the available intelligence, meaning exploitation probability beyond theoretical is unknown. The stored nature of the XSS means a single injected payload persists and can affect multiple digest recipients until remediated, slightly elevating practical risk above a reflected XSS. However, the combination of authentication prerequisite, UI dependency, and scope containment (S:U) makes this a low-urgency, scheduled-patch priority for most organizations rather than an emergency response item.

An authenticated low-privileged YouTrack user creates or edits an article with a title containing a crafted XSS payload. When YouTrack's digest email job runs and includes that article title in the outbound email, any recipient who opens the digest in an HTML-rendering email client and interacts with the content triggers the script in their browser, potentially exfiltrating their YouTrack session cookie to an attacker-controlled endpoint. No public POC has been identified, but stored XSS in email digests is a well-understood and straightforward attack class.