CVE-2025-57731: 
YouTrack vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in JetBrains YouTrack versions before 2025.2.92387. The vulnerability was disclosed on August 20, 2025, and allows attackers to execute malicious scripts through Mermaid diagram content (NVD, JetBrains Advisory).

The vulnerability is identified as CVE-2025-57731 and has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD, while JetBrains rated it as 8.7 (High). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires network access, low attack complexity, low privileges, and user interaction. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If exploited, this vulnerability could allow attackers to execute malicious scripts in the context of other users' browsers when they view affected Mermaid diagram content. This could lead to unauthorized access to sensitive information and potential manipulation of user data within the YouTrack application (AttackerKB).

JetBrains has released version 2025.2.92387 which patches this vulnerability. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).