Description

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-07T17:17:26.500Z",
  "pubdate": "2026-09-07T17:17:26.500Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in JetBrains YouTrack, specifically affecting the Agile board card component.\nThe vulnerability allows an authenticated attacker to inject and persist malicious client-side scripts within custom fields displayed on Agile board cards.\nWhen other users, including those with elevated administrative privileges, view these affected cards, the malicious script executes within their browser session in the context of the YouTrack application.\nThe primary risk implications include unauthorized access to sensitive user data, potential session hijacking, and the ability for an attacker to perform unauthorized actions on behalf of the victim.\nSuccessful exploitation requires the attacker to have sufficient permissions to modify custom field values on Agile board cards.\nThe vulnerability affects all versions of JetBrains YouTrack prior to 2026.2.18634.",
  "technicalDetails": "The vulnerability is categorized as Stored XSS, arising from insufficient server-side input validation and inadequate output encoding when rendering custom field data on Agile board cards.\nThe core issue exists within the component responsible for processing and displaying user-defined content in Agile board widgets. When a user updates a custom field on a card, the application fails to sanitize malicious scripts or HTML tags injected into the field value.\nBecause the input is stored directly in the underlying database, the payload persists across sessions and becomes active for any user viewing the board.\nThe attack flow proceeds as follows: First, an attacker with the necessary permissions to edit board cards identifies a vulnerable custom field. Second, the attacker injects a malicious payload—such as a JavaScript snippet designed to steal session cookies or perform unauthorized API requests—into this field. Third, upon saving the card, the payload is committed to the backend.\nWhen a victim (a legitimate user or administrator) navigates to the Agile board, the application retrieves the card data and embeds the unsanitized script into the document object model (DOM) of the user's browser. The browser interprets the payload as legitimate code and executes it within the application's origin.\nBecause the script runs in the context of the YouTrack domain, it gains access to the victim's session tokens, document cookies, and the ability to interact with the YouTrack REST API, allowing the attacker to bypass Cross-Site Request Forgery (CSRF) protections and perform privileged operations.\nThe vulnerable component is the Agile board card rendering logic. Affected versions include all instances of JetBrains YouTrack up to the version 2026.2.18634. Exploitation necessitates authenticated access but does not require direct system-level access to the server, making it a persistent client-side attack vector.\nThe post-exploitation impact includes persistent session compromise, defacement of the Agile board, redirection of users to malicious external domains, and potential escalation of privileges if an administrator views the compromised card."
}