CVE-2026-75048 is a stored XSS vulnerability (CWE-79) in JetBrains YouTrack affecting versions before 2026.2.18068. The issue occurs due to insufficient sanitization of the fenced code-block language label, enabling attackers to inject malicious scripts that persist in the application and execute when viewed by other users. The vulnerability has a CVSS 3.1 score of 8.2, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially exposing sensitive information or enabling actions on behalf of the user. Confidentiality impact is high, integrity impact is low, and availability is not affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor JetBrains advisories for updates. Until a fix is available, avoid using untrusted input in fenced code-block language labels or restrict user permissions to limit exposure.