Executive brief
JetBrains YouTrack is a project management and issue tracking system used by development teams to organize work and track bugs. A vulnerability in how assignee names are processed allows malicious users to inject code that executes in the browsers of other team members viewing affected issues, potentially compromising account credentials or sensitive project information displayed on screen.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw caused by improper validation of assignee names, which are processed as AngularJS templates without proper sanitization. An attacker with the ability to create or modify assignee names can inject AngularJS template expressions that execute JavaScript in the context of other users' browsers when those users view the affected issue or project data. The attack is stored, meaning the malicious payload persists in the database and affects all subsequent viewers. Exploitation requires the ability to set or modify assignee names, which may be available to authenticated users with certain permissions. JetBrains has patched this vulnerability in YouTrack version 2026.2.18634 and later.
Affected products
- JetBrains YouTrack before 2026.2.18634
Timeline
- 2026-09-07: disclosed
- 2026-02: patched: Fixed in version 2026.2.18634