CVE-2026-100275 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as a stored cross-site scripting (XSS) flaw within JetBrains YouTrack prior to version 2026.2.19197 represents a significant security risk for organizations relying on this issue tracking and project management platform. This specific weakness resides in the workflow error notification toast mechanism, which is a user interface component designed to provide immediate feedback to users when automated workflows encounter errors or fail to execute as expected. In web application architecture, such notifications are typically rendered dynamically using JavaScript frameworks that inject content into the Document Object Model based on server-side responses. The core technical flaw arises from insufficient sanitization of input data before it is processed and displayed within these toast notifications. When a workflow error message contains malicious script payloads rather than plain text, the browser interprets these scripts as executable code due to the lack of proper encoding or validation mechanisms in the rendering logic.
This vulnerability falls under the Common Weakness Enumeration category CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. The stored nature of this XSS implies that the malicious payload is not merely transient but persists within the application's database or configuration files associated with workflow definitions. Consequently, every user who views a ticket or dashboard where an affected workflow has failed will have their browser execute the injected script upon loading the notification toast. This persistence distinguishes it from reflected XSS attacks and increases the potential blast radius of exploitation significantly. The attacker does not need to trick a specific victim into clicking a crafted link; instead, they can trigger the vulnerability by causing a workflow error that includes their payload, ensuring exposure to any user with access to the affected project or ticket.
From an operational perspective, the impact of this stored XSS is severe and multifaceted. An attacker who successfully exploits this flaw can execute arbitrary JavaScript in the context of the victim's session. This capability allows for a wide range of malicious activities including but not limited to stealing session cookies, authentication tokens, and other sensitive credentials that are transmitted with HTTP requests. The attacker could also perform actions on behalf of the victim, such as modifying workflow configurations, creating new issues, or altering existing ones without authorization. Furthermore, persistent scripts can be used to deface the user interface, redirect users to phishing sites designed to harvest additional credentials, or install malware if combined with other browser vulnerabilities. For enterprise environments using YouTrack for critical project management, this undermines trust in the platform's integrity and exposes sensitive business data contained within tickets and workflow logs.
The exploitation of this vulnerability aligns with several tactics defined by the MITRE ATT&CK framework. Specifically, it relates to T1059 Command and Scripting Interpreter where JavaScript is used as a vehicle for execution. It also connects to T1078 Valid Accounts if the attacker uses stolen credentials obtained via the XSS payload to maintain persistence or escalate privileges within the application. Additionally, the act of stealing session tokens falls under T1539 Steal Web Session Cookie which facilitates unauthorized access without needing to crack passwords directly. The stored aspect also touches upon data manipulation aspects seen in techniques like T1074 Data Staged if the attacker exfiltrates information through beaconing mechanisms embedded within the malicious script.
Mitigation for this vulnerability requires immediate action by system administrators and developers managing JetBrains YouTrack instances. The primary remediation is to upgrade the application to version 2026.2.19197 or later, where the vendor has addressed the input validation issues in the workflow error notification component. Until an upgrade can be performed, organizations should consider implementing a Web Application Firewall that includes rules capable of detecting and blocking common XSS payloads within HTTP request parameters related to workflow configurations. Additionally, reviewing existing workflows for any manually entered text fields that might have been used as vectors during active exploitation is advisable. Enforcing strict Content Security Policy headers can also help mitigate the impact by restricting the sources from which scripts are allowed to execute, although this must be configured carefully to avoid breaking legitimate application functionality. Regular security audits and penetration testing of custom workflow integrations will further reduce the risk of similar vulnerabilities in related components.