JetBrains YouTrack EUVD-2026-90584

Exploitation requires the ability to submit Mermaid diagram or LaTeX markup into YouTrack content (issue descriptions, comments, or similar fields) that is rendered to other users - in most deployments this presumes an account with content-creation rights, unless anonymous/guest issue reporting is enabled. Execution additionally requires a victim to view the attacker-controlled content (UI:R), so the payload fires in whichever user's browser opens the issue; targeting a project admin or maintainer maximizes impact. It is limited to YouTrack instances running a version before 2026.2.19422 and depends on the Markdown/Mermaid/LaTeX rendering feature being used; upgrading to 2026.2.19422 or later removes the flaw.

Signals are mixed and lean toward moderate real-world priority despite the high 8.1 CVSS. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) implies a network-reachable, low-complexity flaw with no privileges but requiring victim interaction, and claims High confidentiality AND integrity impact. Two aspects of that vector warrant scrutiny: (1) PR:N is optimistic for a stored XSS in an issue tracker, since injecting Mermaid/LaTeX content normally requires the ability to create/edit an issue or comment, i.e. an authenticated account (PR:L) unless guest/anonymous reporting is enabled; and (2) C:H/I:H is aggressive for reflected/stored script execution - JetBrains likely reasons that an XSS firing in an authenticated maintainer or admin session can lead to session/token theft and issue tampering, but many analysts would score such impact as C:L/I:L. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so this is no public exploit identified at time of analysis - not active exploitation. SSVC inputs are absent. Net: a credible but not urgent server-side web vulnerability; patch in normal cycle. Note the PR:N vs. likely-authenticated-injection tension and the high C/I rating should be verified against the JetBrains advisory.

An attacker with the ability to post content in YouTrack (e.g., an issue, comment, or description accepting Mermaid diagram or LaTeX markup) embeds a malicious payload that survives sanitization. When a developer, project maintainer, or administrator later views that issue, the script executes in their authenticated browser session, enabling session/token theft or actions on their behalf. No public exploit code is referenced, and successful exploitation depends on a victim opening the attacker-controlled content (UI:R).