CVE-2026-86484: CWE-79 in JetBrains YouTrack

JetBrains YouTrack versions prior to 2026.2.18634 contain an AngularJS template injection vulnerability in the handling of assignee names. This flaw allows stored cross-site scripting (CWE-79) attacks, where malicious scripts can be injected and persistently stored, potentially executing in the browsers of other users who view the affected assignee names. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact.

The vulnerability enables stored XSS attacks that can lead to limited confidentiality and integrity compromise within YouTrack. Attackers with low privileges can inject scripts that execute in other users' browsers, potentially exposing sensitive information or altering data. There is no indication of availability impact or widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory content is provided, users should monitor JetBrains communications for updates and apply any official fixes once available. Until then, consider restricting privileges for users who can modify assignee names and apply input sanitization or filtering if possible.