CVE-2026-86483: CWE-79 in JetBrains YouTrack

JetBrains YouTrack before version 2026.2.18634 is affected by a stored XSS vulnerability through a custom field on Agile board cards. An attacker with low privileges and requiring user interaction can inject malicious scripts that execute with the privileges of other users, potentially leading to information disclosure or session hijacking. The vulnerability is tracked as CVE-2026-86483 and corresponds to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users viewing the affected Agile board cards. This could lead to limited confidentiality and integrity impacts, such as theft of user session tokens or manipulation of displayed content. There is no impact on availability reported. No known exploits are currently observed in the wild.

A fix is available in JetBrains YouTrack version 2026.2.18634. Users should upgrade to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official update. No additional mitigation steps are indicated by the vendor advisory.