CVE-2026-123325 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains YouTrack versions prior to 2025.3.170763, as well as specific builds within the 2026 release cycle including 2026.1.14150 and 2026.2.19656, represents a critical failure in input validation and security boundary enforcement within the plugin sandbox interface. This flaw allows an attacker to inject untrusted remote code into the application environment through specifically crafted requests directed at the plugin management or sandbox pages. The core technical issue stems from insufficient sanitization of user-supplied data that is subsequently processed by the underlying JavaScript engine or server-side rendering components responsible for handling plugin configurations and execution contexts. By exploiting this weakness, a malicious actor can bypass the intended isolation mechanisms designed to restrict plugins to their designated operational boundaries, thereby achieving arbitrary code execution within the context of the YouTrack application process.
From a technical perspective, this vulnerability aligns with CWE-94, commonly known as Improper Control of Generation of Code or Script, often referred to broadly under Cross-Site Scripting (XSS) when client-side effects are prioritized, or Remote Code Execution if server-side implications exist due to the nature of plugin sandboxes in enterprise tools. The attack vector typically involves manipulating parameters that control how external resources are loaded or executed within the sandboxed environment. If the application fails to properly validate whether a requested script source is from an approved whitelist or correctly encodes special characters, it may inadvertently execute malicious payloads hosted on remote servers controlled by the attacker. This bypasses standard security controls such as Content Security Policy directives if those policies are not strictly enforced or can be circumvented through specific parsing ambiguities in the browser's JavaScript engine when interacting with the plugin API endpoints.
The operational impact of this vulnerability is severe, particularly for organizations relying on YouTrack for project management and issue tracking where sensitive data resides. Successful exploitation could lead to a complete compromise of the application instance, allowing attackers to steal session cookies, access confidential project details, modify or delete issues, and potentially pivot further into internal networks if the server has broader connectivity privileges. In multi-tenant environments, this could result in cross-user contamination, compromising other teams' data within the same deployment. The ability to execute arbitrary code effectively neutralizes the integrity guarantees provided by the platform, turning a collaborative tool into an attack vector against both end-users and system administrators who interact with the plugin management features.
Mitigation strategies must prioritize immediate patching to the latest stable release where this issue has been resolved through rigorous input validation and stricter enforcement of sandbox isolation protocols. Administrators should ensure that all plugins are sourced exclusively from the official JetBrains marketplace or verified internal repositories, avoiding third-party sources until trust can be established. Additionally, implementing robust Content Security Policy headers with strict script-src directives can help mitigate potential exploitation by restricting where scripts can load from. Regular security audits and penetration testing of custom plugin integrations are recommended to identify similar weaknesses in input handling logic before they can be leveraged for malicious purposes.