Executive brief
JetBrains YouTrack, a project management and issue tracking tool, was vulnerable to a security flaw in how it displays Mermaid diagrams. An attacker could inject malicious styling code into these diagrams, potentially altering the appearance of the user interface for other team members. While this does not directly expose sensitive data, it could be used to mislead users or deface project pages.
Technical details
A CSS injection vulnerability existed in JetBrains YouTrack versions prior to 2026.2.17012. The flaw was located in the Mermaid diagram rendering component, where insufficient sanitization of user-supplied diagram definitions allowed for the injection of arbitrary CSS. An authenticated attacker with permissions to create or edit content (such as issues or comments) could exploit this by embedding malicious Mermaid syntax. Successful exploitation requires a victim to view the affected diagram (User Interaction). The impact is limited to integrity, specifically the improper restriction of rendered UI layers (CWE-1021), which can lead to UI redressing or defacement within the application context.
Affected products
- JetBrains YouTrack before 2026.2.17012
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory