This vulnerability (CVE-2026-49368) in JetBrains YouTrack is a stored XSS issue classified under CWE-79. It affects versions prior to 2026.1.13162 and involves injection of malicious scripts into project notification templates. The CVSS 3.1 base score is 8.7, reflecting high impact with network attack vector, low attack complexity, requiring privileges and user interaction, and resulting in complete confidentiality and integrity compromise but no availability impact. The vulnerability is published but lacks explicit vendor remediation details. The product is not a cloud service, so remediation depends on user patching.

Successful exploitation allows an attacker with limited privileges and requiring user interaction to execute arbitrary scripts in the context of affected users, potentially leading to full confidentiality and integrity compromise of the YouTrack environment. Availability is not impacted. This can result in unauthorized data access or manipulation within the affected project notification templates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product is not cloud-hosted, users should monitor JetBrains advisories for an official fix and apply updates promptly once available. Until then, limit privileges to trusted users and avoid interacting with suspicious notification templates.