A stored cross-site scripting (XSS) vulnerability exists in JetBrains Datalore versions prior to 2026.4. The vulnerability occurs in notebook charts via the Vega editor link, allowing an attacker to inject malicious scripts that are stored and later executed in the context of a user's browser session.