Description

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T11:17:12.530Z",
  "pubdate": "2026-11-06T11:17:12.530Z",
  "executiveSummary": "This vulnerability involves an improper handling of untrusted input within the plugin sandbox page of JetBrains YouTrack, facilitating Remote Code Execution (RCE).\nThe flaw allows unauthorized or authenticated attackers to inject and execute arbitrary code by leveraging the sandbox environment's inadequate security controls.\nAffected versions include JetBrains YouTrack prior to 2025.3.170763, 2026.1.14150, and 2026.2.19656.\nSuccessful exploitation grants an attacker the ability to execute code with the privileges of the YouTrack application process, potentially leading to full system compromise, data exfiltration, and lateral movement within the hosting infrastructure.\nThe vulnerability represents a critical risk to the integrity, confidentiality, and availability of the YouTrack instance and any connected systems.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization and validation of inputs processed by the JetBrains YouTrack plugin sandbox page.\nThe plugin sandbox mechanism, designed to provide an isolated environment for extension development and testing, fails to adequately enforce security boundaries against malicious payloads injected via the web interface.\nAn attacker can exploit this by injecting crafted, untrusted code into the sandbox environment, which is then processed by the underlying runtime engine without proper restriction.\nThe attack flow typically involves navigating to the specific vulnerable component within the plugin sandbox configuration or management interface and providing input that deviates from expected plugin metadata or configuration schemas.\nBecause the sandbox environment interacts with the core application logic to facilitate plugin functionality, an attacker can escape the intended execution constraints, leading to arbitrary code execution on the host system.\nThe impact of this execution is scoped to the user context running the YouTrack application service, which often possesses elevated system permissions required for administrative tasks, log file access, and database interactions.\nThe exposure of this vulnerability is primarily network-based, as the web-accessible plugin management interface serves as the primary attack vector.\nPost-exploitation activities may include, but are not limited to, unauthorized access to sensitive internal data (including issue trackers and user credentials), installation of persistent backdoors, and the utilization of the compromised host as a pivot point for further network reconnaissance or lateral movement.\nThe affected versions include all releases prior to the identified security patches: 2025.3.170763, 2026.1.14150, and 2026.2.19656, necessitating an immediate upgrade for all instances currently running these vulnerable versions."
}