CVE-2026-103489 is an HTML injection vulnerability in JetBrains YouTrack before version 2026.2.19422. The flaw occurs in the handling of VCS command failure notifications, where injected HTML content could be rendered. The vulnerability is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 2.0, reflecting a low severity with network attack vector, high attack complexity, required privileges, and user interaction. No known exploits are reported in the wild. No official patch or vendor advisory is provided in the input data.

The vulnerability allows an attacker with high privileges and user interaction to inject HTML content in VCS command failure notifications. The impact is limited to integrity with no confidentiality or availability impact. Given the low CVSS score and required conditions, the risk is considered low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor JetBrains advisories for updates and avoid exposing privileged users to untrusted inputs in VCS commands until a fix is available.