Executive brief
JetBrains YouTrack is a web-based project tracking and issue management platform used by development teams. A stored cross-site scripting vulnerability in code-block formatting allowed attackers to inject malicious scripts into issue descriptions or comments that would execute when other users viewed the content, potentially leading to account compromise or data theft.
Technical details
This is a stored XSS vulnerability (CWE-79) in YouTrack's markdown/rich-text rendering engine, specifically in how fenced code-block language labels are processed and sanitized. The vulnerability allows an attacker to inject arbitrary JavaScript into the language label parameter of code blocks (e.g., ```[PAYLOAD]). Because the payload is stored server-side and reflected to all users viewing the affected issue or comment, no user interaction beyond normal viewing is required. An authenticated user with permission to create or edit issues/comments can exploit this to execute JavaScript in the browser context of any other user who reads the content. The vulnerability was patched in version 2026.2.18068.
Affected products
- JetBrains YouTrack before 2026.2.18068
Timeline
- 2026-08-17: disclosed
- 2026-02-18: patched: Fixed in version 2026.2.18068