CVE-2026-103493 in YouTrack
Summary
by MITRE • 10/01/2026
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19422 represents a critical security flaw rooted in the insufficient sanitization of user-supplied input within rich text editing fields that support embedded visualizations. Specifically, this stored cross-site scripting attack vector exploits the rendering engines for Mermaid diagrams and LaTeX mathematical expressions. When an authenticated user inputs malicious script payloads disguised as valid diagram code or mathematical notation into issue descriptions, comments, or other editable content areas, the application fails to adequately strip or encode dangerous JavaScript constructs before storing them in the database. This lack of rigorous input validation allows the attacker to persistently inject executable client-side scripts that are subsequently served to any user who views the compromised item.
From a technical perspective, this flaw falls under CWE-79, which classifies improper neutralization of input during web page generation, commonly known as cross-site scripting. The specific mechanism involves the application's parser for Mermaid and LaTeX content not strictly enforcing allow-lists on executable code blocks or failing to escape special characters that trigger script execution in modern browsers. Because the payload is stored server-side rather than being transiently passed via URL parameters, it does not require social engineering tricks like phishing links to be effective against other users; simply viewing a ticket containing the malicious content triggers the exploit. This persistence distinguishes it from reflected XSS and increases its severity as it can affect multiple victims over an extended period without further interaction from the initial attacker.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for project management and issue tracking, particularly in collaborative environments where team members frequently review each other's work. An successful exploitation allows a malicious insider or an account compromised by another vector to execute arbitrary JavaScript in the context of the victim’s session. This can lead to session hijacking through cookie theft, credential harvesting via keyloggers embedded in the injected script, defacement of the user interface, or redirection to phishing sites designed to steal corporate credentials. In severe cases, if combined with other vulnerabilities such as insecure direct object references, it could facilitate broader lateral movement within the organization’s infrastructure by exfiltrating sensitive project data or configuration details visible on the compromised pages.
To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19422 or later, where these input sanitization issues have been addressed through enhanced validation rules and stricter output encoding for Mermaid and LaTeX renderers. Until an upgrade is feasible, administrators should consider restricting the ability of lower-privileged users to edit rich text fields that support embedded content if such functionality is not strictly required for their workflow. Additionally, implementing a Content Security Policy with strict script-src directives can help mitigate the impact by preventing unauthorized scripts from executing in the browser environment. Regular security audits and penetration testing focused on input validation across all user-facing forms are recommended to identify similar weaknesses before they can be exploited. This incident underscores the importance of treating rich text editors as potential attack surfaces requiring rigorous sanitization, aligning with OWASP guidelines for secure coding practices regarding dynamic content rendering.