Description

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-09-07T17:17:26.607Z",
  "pubdate": "2026-09-07T17:17:26.607Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in JetBrains YouTrack versions prior to 2026.2.18634, stemming from improper handling of user-supplied input within assignee names.\nThe vulnerability is rooted in an AngularJS template injection flaw, allowing an attacker to inject malicious scripts into the application interface.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript in the context of a victim's browser session.\nThis can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or the exfiltration of sensitive project data.\nThe vulnerability affects all deployments of the specified YouTrack versions. Exploitation typically requires an attacker to possess permissions sufficient to modify or influence assignee fields, which are subsequently rendered in the application's UI.\nThe risk is categorized as high due to the potential for complete compromise of a user's session and the potential for lateral movement within the YouTrack environment if administrative accounts are targeted.",
  "technicalDetails": "The vulnerability originates from a template injection vulnerability within the AngularJS framework implementation utilized by YouTrack. Specifically, the application failed to properly sanitize or escape input provided in the 'assignee' field before processing it through the AngularJS rendering engine.\nAngularJS utilizes client-side template expressions enclosed in double curly braces ({{ }}) to dynamically bind data. When the application incorporates unsanitized user input into these templates, the AngularJS compiler interprets the input as executable code rather than plain text.\nAn attacker can exploit this by crafting a malicious payload containing AngularJS expressions—such as '{{constructor.constructor('alert(1)')()}}'—and inserting it into an assignee name field. Once this input is saved, it is persisted in the backend database.\nWhen another user, such as an administrator, views the issue, ticket, or dashboard where this assignee name is rendered, the YouTrack frontend retrieves the malicious string from the database and passes it to the AngularJS compiler.\nThe compiler executes the embedded JavaScript payload within the victim's browser context. Because this occurs within the origin of the YouTrack application, the malicious script inherits full access to the victim's session cookies, local storage, and the Document Object Model (DOM).\nThe attack flow follows these steps: 1) The attacker injects a malicious AngularJS expression into an assignee field. 2) The server accepts and stores this payload. 3) A target user navigates to a page rendering the compromised assignee name. 4) The client-side AngularJS framework executes the payload during the data-binding process. 5) Arbitrary JavaScript execution is achieved, potentially allowing for session token theft, unauthorized API requests, or redirection to malicious sites.\nThe vulnerable component is the frontend data-binding mechanism responsible for rendering user-controlled identity strings. This vulnerability does not require complex network positioning, as it is a stored XSS vector within the application's core functionality. The requirement for exploitation is limited to the ability to influence assignee name data, which is standard behavior in collaborative issue-tracking environments."
}