JetBrains YouTrack versions prior to 2025.2.92387 are vulnerable to a stored cross-site scripting attack, which could lead to unauthorized actions within the browser of an authenticated user.

The flaw is a stored XSS (CWE-79) triggered by processing malicious Mermaid diagram content. An authenticated user with low privileges can inject scripts that execute in the context of other users, including administrators, when they view the affected diagram.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session. This can result in unauthorized actions, session hijacking, or the theft of sensitive information, presenting a significant risk to organizational data integrity. With a CVSS score of 8.7, this is classified as a high-severity issue that requires prompt remediation to prevent account compromise.

Immediate Action: Update JetBrains YouTrack to version 2025.2.92387 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Review application access logs and audit trails for unusual activity related to diagram creation or modification by unauthorized or suspicious user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS payloads.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and unauthorized access, administrators must prioritize the update to version 2025.2.92387. Because the vulnerability allows an attacker to target other users within the environment, failing to patch exposes the organization to lateral movement and session compromise. Ensure all instances are updated immediately to mitigate this risk.