CVE-2026-75048 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18068 represents a significant security flaw within the platform's markdown rendering engine, specifically concerning the handling of fenced code blocks. This issue falls under the category of Stored Cross-Site Scripting, commonly referred to as XSS, which is classified under CWE-79 in the Common Weakness Enumeration standard. The core technical flaw lies in the insufficient sanitization and validation of user-supplied input within the language label field of a fenced code block syntax. In typical markdown implementations, users can specify the programming language for syntax highlighting by appending a string after the opening triple backticks, such as ```javascript or ```python. YouTrack's parser failed to adequately escape special characters or restrict allowed values in this specific context, allowing an attacker to inject malicious JavaScript payloads directly into these labels.
The operational impact of this vulnerability is severe due to its stored nature. Unlike reflected XSS, where the payload must be delivered via a crafted link and executed immediately upon viewing by a victim, stored XSS persists on the server side. An authenticated user with appropriate permissions can create an issue or comment containing the malicious code block label. Once saved, this content becomes part of the application's database and is subsequently rendered in the HTML output whenever other users view that specific item. This means that any administrator, developer, or team member accessing the affected ticket will have their browser execute the injected script automatically. The consequences can range from session hijacking through cookie theft to complete account takeover if multi-factor authentication is not strictly enforced or bypassed via social engineering facilitated by the XSS payload. Furthermore, attackers could potentially perform actions on behalf of the victim, such as modifying issue details, adding collaborators, or exfiltrating sensitive project data visible within that context.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates initial access and credential harvesting through T1059 Command and Scripting Interpreter via browser-based execution. The attacker leverages the trusted domain of YouTrack to bypass same-origin policy restrictions, allowing the malicious script to interact seamlessly with the application's DOM and API endpoints. This trust relationship is critical because browsers treat scripts originating from a site as trustworthy by default unless strict Content Security Policies are in place. Without robust CSP headers restricting script sources or nonce-based execution policies, the browser will happily execute the injected code, leading to unauthorized access and potential data breaches across the organization's development workflow tools.
Mitigation strategies for this vulnerability primarily involve upgrading to JetBrains YouTrack version 2026.2.18068 or later, where the developers have implemented stricter input validation and output encoding mechanisms within the markdown parser. The fix ensures that any characters in the language label field are properly escaped before being rendered into HTML, neutralizing their ability to act as executable code. For organizations unable to upgrade immediately due to operational constraints, implementing a Web Application Firewall with rules designed to detect and block XSS payloads in form fields related to issue descriptions or comments can provide an additional layer of defense. Additionally, enforcing strict Content Security Policy headers that disallow inline scripts unless explicitly whitelisted via nonces or hashes will significantly reduce the impact even if such vulnerabilities are present. Regular security audits focusing on input validation across all user-facing text areas and ensuring that markdown parsers use secure libraries like marked with appropriate sanitization options are also recommended best practices to prevent similar issues in future versions.