A Cross-Site Scripting (XSS) vulnerability in JetBrains YouTrack could allow authenticated attackers to execute arbitrary scripts, compromising user sessions and data.

This is a Cross-Site Scripting (CWE-79) vulnerability that requires an authenticated user to trigger the malicious script execution, often facilitated by a victim interacting with a crafted UI element.

An authenticated attacker could leverage this vulnerability to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of other users, including administrators. With a CVSS score of 8.7, the impact on organizational security is significant, as it undermines the trust and integrity of the YouTrack collaboration platform.

Immediate Action: Update JetBrains YouTrack to version 2026.1.13162 or later immediately.

Proactive Monitoring: Monitor web application traffic for patterns indicative of XSS attempts, such as unusual script tags or encoded payloads in input fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, effectively mitigating the impact of potential XSS attacks.

Public Exploit Available: No (exploit_available: false)

JetBrains YouTrack instances should be updated immediately to the latest patched version to prevent potential session compromise. Security teams should prioritize patching this vulnerability to ensure that the collaboration environment remains secure against authenticated-user-driven attacks.