JetBrains YouTrack before version 2026.2.18068 is affected by a stored XSS vulnerability (CVE-2026-75048) via the fenced code-block language label. This vulnerability allows an attacker to inject malicious scripts that are stored persistently and executed when other users view the affected content. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure (high confidentiality impact) and limited integrity impact. There is no impact on availability. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or official fix information is provided, users should monitor JetBrains advisories for updates. Until a fix is available, consider restricting or sanitizing user input related to fenced code-block language labels as a temporary mitigation.