EUVD-2026-90580
GHSA-26rm-75r8-j682
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged YouTrack access
-
DeliveryConfigure VCS integration with crafted HTML
-
ExploitTrigger VCS command failure
-
ExecutionVictim views failure notification
-
ImpactInjected HTML renders in browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the YouTrack VCS integration feature to be in use so that VCS command-failure notifications are generated and rendered. The attacker needs high privileges (PR:H) sufficient to influence the content of those failure notifications, and a victim user must view the affected notification (UI:R). High attack complexity (AC:H) further limits practical exploitation. Affected deployments are JetBrains YouTrack instances before version 2026.2.19422; upgrading to 2026.2.19422 or later removes the condition. |
| Impact | This is a genuinely low-priority issue despite being a well-formed vulnerability. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) scores just 2.0 and is heavily gated on multiple fronts: high attack complexity (AC:H), high privileges required (PR:H), and victim user interaction (UI:R), with only a low integrity impact (I:L) and no confidentiality or availability impact. The attack surface is narrow - HTML injection into VCS command-failure notifications - meaning an attacker must already possess privileged access sufficient to configure/trigger VCS integrations whose failure messages are rendered to a victim. There is no exploitation signal to elevate this: no CISA KEV listing, no public POC, and no EPSS data supplied. No conflicting signals exist (CVSS network vector is consistent with a web-based notification rendering flaw), and no SSVC decision data was provided. Net assessment: real but marginal, firmly in the patch-on-normal-cycle category rather than an urgent priority. |
| Exploit ScenarioDerived | A privileged YouTrack user configures a VCS integration such that a command-failure notification embeds crafted HTML; when another user views the resulting failure notification, the injected markup renders in their browser session. Because the flaw requires high privileges, high complexity, and victim interaction, and yields only limited integrity impact, realistic abuse is confined to insiders or compromised privileged accounts. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
RemediationAI
Apply the vendor-released patch by upgrading JetBrains YouTrack to version 2026.2.19422 or later. This version corrects the HTML injection in VCS command failure notifications. For deployments unable to upgrade immediately, consider disabling VCS integration entirely or restricting which users have permissions to trigger VCS command failures (since high privileges are required to exploit), though these workarounds may impact functionality and are not officially documented. No public exploit code or active exploitation has been identified, and the risk is low given the high attack complexity, required privileges, and user interaction. Refer to the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for further details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains YouTrack is a project management and issue tracking platform that integrates with version control systems (VCS) such as Git. When a VCS command fails (e.g., due to authentication or network issues), YouTrack generates a notification that is rendered as HTML in the web UI. The vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), arises because the failure notification content is not properly sanitized before being inserted into the HTML DOM. An attacker who can influence the content of these notifications (requiring high privileges, PR:H) can inject arbitrary HTML, which may execute scripts in the context of a victim's session when the victim views the notification (UI:R). The high attack complexity (AC:H) and limited impact (only integrity, I:L) are reflected in the CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. The affected CPE is cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, covering all versions before 2026.2.19422.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
HTML injection requires privileged control over VCS notification content (PR:H) plus victim view (UI:R) and a non-trivial trigger (AC:H), yielding only limited integrity impact.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB