CVE-2026-86484: CWE-79 in JetBrains YouTrack

JetBrains YouTrack before version 2026.2.18634 is affected by an AngularJS template injection vulnerability in the handling of assignee names. This flaw leads to stored cross-site scripting (CWE-79), where malicious templates can be injected and persistently stored, potentially executing in the context of other users viewing the affected data. The CVSS 3.1 base score is 4.6, indicating a medium severity vulnerability with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker with low privileges to inject malicious AngularJS templates into assignee names, which are stored and later rendered in the application. This may lead to limited confidentiality and integrity impacts through execution of arbitrary scripts in the context of other users. There is no known active exploitation in the wild.

A fix is available in JetBrains YouTrack version 2026.2.18634. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official patch.