JetBrains YouTrack before version 2026.2.19422 contains a stored XSS vulnerability (CWE-79) due to improper sanitization of Mermaid and LaTeX content. An attacker can inject malicious scripts that are stored and later executed in the context of users viewing the affected content. The CVSS 3.1 score of 8.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. The vulnerability does not affect availability. No exploits are currently known in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising user confidentiality and integrity of data within YouTrack. This could allow theft of sensitive information or unauthorized actions performed on behalf of the user. Availability is not impacted.

A fix is available in JetBrains YouTrack version 2026.2.19422. Users should upgrade to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on user action to apply the update. No other mitigation guidance is provided.