Description

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-17T16:17:51.870Z",
  "pubdate": "2026-08-17T16:17:51.870Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability has been identified in JetBrains YouTrack prior to version 2026.2.18068. This security flaw originates from the improper handling of user-supplied input within the fenced code-block language label rendering process. An authenticated remote attacker possessing permissions to create or edit issues, comments, or articles containing markdown formatted text can inject malicious JavaScript payloads directly into the application interface. When a victim views the affected resource, the malicious script executes within the context of their active browser session. The potential impact of this vulnerability includes session hijacking, unauthorized access to sensitive data, forced execution of unintended actions on behalf of the user, and potential privilege escalation depending on the victim's access level within the YouTrack instance. Exploitation requires user interaction, specifically the rendering and viewing of the malicious code-block language label by a valid user. Mitigation necessitates updating the JetBrains YouTrack deployment to the patched version 2026.2.18068 or later where input sanitization and context-aware output encoding are properly enforced for fenced code-block language labels.",
  "technicalDetails": "The vulnerability is classified as a Stored Cross-Site Scripting (XSS) flaw affecting JetBrains YouTrack before version 2026.2.18068. The root cause lies in the application's markdown parser and rendering engine, specifically within the subsystem responsible for processing fenced code-block language labels. When rendering markdown content containing fenced code blocks, the application fails to adequately sanitize or encode the string provided as the language identifier before embedding it into the Document Object Model (DOM).\nAn attacker initiates the attack flow by crafting a specially engineered payload designed to break out of the intended attribute or tag context within the language label parameter of a fenced code block. This payload is subsequently injected into persistent application storage via standard vectors such as issue descriptions, comments, or knowledge base articles. Because the input is stored without proper neutralization, it is served dynamically to any user who subsequently navigates to the affected resource.\nUpon retrieval from the database, the server transmits the unescaped markdown payload to the client-side application. As the browser parses the HTML generated by the markdown renderer, the malicious script contained within the language label is interpreted as executable JavaScript rather than plain text. This code executes in the security context of the victim's browser session, granting the script access to Document cookies, Local Storage, Session Storage, and the ability to perform authorized requests on behalf of the user via the Document Object Model or XMLHttpRequest/Fetch APIs.\nThe attack vector is network-exploitable, requiring the attacker to have network access to the YouTrack instance and sufficient privileges to submit content containing markdown. Authentication is required to inject the stored payload, but no specialized administrative privileges are necessary if standard users can create issues or comments. The affected component is the markdown rendering engine handling fenced code-block language labels in JetBrains YouTrack versions prior to 2026.2.18068."
}