CVE-2026-100257 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18991 represents a critical intersection of cross-site request forgery and server-side rendering flaws, specifically triggered during the PDF export functionality. This issue arises from an insufficient validation mechanism within the application's document generation pipeline, where user-supplied input in the form of stored XHTML is processed without adequate sanitization or context-aware encoding before being rendered into a portable document format. By injecting malicious HTML structures that include script tags or event handlers, an attacker can manipulate the browser environment when the resulting PDF preview or download link is accessed by another authenticated user within the same session context.
From a technical perspective, this flaw leverages the trust relationship between the web application and its users through stored cross-site scripting vectors embedded in XHTML content. When a victim with administrative privileges or specific export permissions initiates a PDF generation request for an issue containing the injected payload, the server processes the input as valid markup. The resulting document may contain hidden elements that execute JavaScript upon rendering within certain viewer contexts or when previewed inline by the browser's integrated PDF handler. This execution occurs under the authority of the victim’s session cookies and authentication tokens, effectively bypassing standard security controls such as SameSite cookie attributes if not properly configured to restrict cross-origin requests during file generation operations.
The operational impact of this vulnerability is severe due to its potential for account takeover and data exfiltration within enterprise environments relying on YouTrack for project management. An attacker can perform actions on behalf of the victim, including modifying issue details, changing user roles, or accessing sensitive project information that would otherwise be restricted by role-based access controls. Furthermore, because the payload is stored in the database as part of an issue’s description or comment, it persists until manually removed, creating a persistent threat vector against any team member who views the affected item and triggers the export function. This persistence amplifies the risk significantly compared to reflected XSS attacks, which require immediate user interaction with a crafted link.
This vulnerability aligns closely with CWE-832, which describes cross-site request forgery weaknesses where insufficient verification of intended action occurs, as well as CWE-79, pertaining to improper neutralization of input during web page generation known commonly as cross-site scripting. In the context of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter for executing arbitrary code within the victim’s browser session and potentially T1213 Data from Information Repositories if sensitive data is exfiltrated via beacon requests initiated by the injected scripts. The attack chain typically involves initial injection during issue creation followed by exploitation through legitimate administrative workflows, demonstrating how trusted processes can be subverted when input validation is lax in secondary features like reporting tools.
Mitigation strategies must prioritize immediate patching to version 2026.2.18991 or later, where JetBrains has implemented stricter sanitization routines for XHTML content destined for PDF generation. Administrators should also enforce Content Security Policy headers that restrict inline script execution and ensure that SameSite cookie attributes are set to Strict or Lax to mitigate CSRF risks associated with state-changing requests triggered by external scripts. Additionally, implementing output encoding specific to the HTML context within exported documents can prevent malicious payloads from being interpreted as executable code rather than static text. Regular audits of user-generated content stored in issue fields and comments should be conducted to detect any residual injected markup that may have been introduced prior to the patch deployment.