CVE-2026-103493: 
YouTrack vulnerability analysis and mitigation

CVE-2026-103493 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains YouTrack that allows malicious scripts to be injected via Mermaid diagram and LaTeX content rendering. All YouTrack versions before 2026.2.19422 are affected. The vulnerability was published and patched on October 1, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization of user-supplied Mermaid diagram syntax and LaTeX mathematical content before it is stored and subsequently rendered in the browser. An unauthenticated attacker can craft malicious payloads embedded within Mermaid or LaTeX blocks, which are persisted in YouTrack's data store and executed in the browsers of any user who views the affected content. No authentication is required to submit the payload, but victim user interaction (viewing the content) is necessary for execution (GitHub Advisory, JetBrains).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the security context of any YouTrack user who views the malicious content, resulting in high confidentiality and integrity impact. Attackers can steal session cookies, authentication tokens, or perform unauthorized actions on behalf of victims — including modifying issues, accessing sensitive project data, or escalating privileges within the YouTrack instance. Availability is not directly impacted, but the potential for account takeover and data exfiltration makes this a significant risk for organizations using YouTrack for project management and issue tracking (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible or internally reachable JetBrains YouTrack instance running a version prior to 2026.2.19422.
2. Craft malicious payload: Prepare a stored XSS payload embedded within a Mermaid diagram block (e.g., within a graph or sequenceDiagram definition) or a LaTeX expression that, when rendered, executes JavaScript — for example, exploiting unsafe HTML injection points within the rendering pipeline.
3. Inject payload: Submit the malicious Mermaid or LaTeX content into a YouTrack issue, comment, article, or other content field that supports these markup types. No authentication may be required depending on the YouTrack instance's access configuration.
4. Wait for victim interaction: When a legitimate user (e.g., a developer or project manager) views the affected issue or page, the malicious script executes in their browser.
5. Achieve objective: The executed script can exfiltrate session cookies or tokens to an attacker-controlled server, perform actions on behalf of the victim (e.g., modify issues, access private projects), or serve as a pivot for further attacks within the organization (GitHub Advisory).

• Network: Outbound HTTP/S requests from user browsers to unexpected external domains shortly after viewing YouTrack issues or articles; unusual POST requests to attacker-controlled endpoints containing cookie or token data.
• Logs: YouTrack access logs showing submission of issues or comments containing Mermaid/LaTeX blocks with embedded HTML tags or JavaScript event handlers (e.g., onerror, onload, <script>).
• Application Behavior: Users reporting unexpected logouts, session hijacking, or unauthorized changes to YouTrack issues/projects after viewing specific content.
• Content Artifacts: Stored issues or articles in YouTrack containing Mermaid or LaTeX blocks with suspicious inline HTML or JavaScript patterns (e.g., javascript:, <img src=x onerror=...>, fetch() calls to external URLs) (GitHub Advisory).

JetBrains has released a fix in YouTrack version 2026.2.19422; all users should upgrade immediately (JetBrains). As interim mitigations, administrators should implement strict Content Security Policy (CSP) headers to restrict unauthorized script execution, and restrict the ability to submit Mermaid or LaTeX content to trusted users only. Sanitizing and validating all Mermaid and LaTeX input before storage and rendering is also recommended until patching is completed (GitHub Advisory).