CVE-2026-86484 in YouTrack
Summary
by MITRE • 09/07/2026
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified as a critical security flaw within JetBrains YouTrack versions prior to the release of build 2026.2.18634 involves a Stored Cross-Site Scripting (XSS) attack vector rooted in improper input validation and output encoding mechanisms. Specifically, the defect resides in how the application processes assignee names associated with issues or tasks within its tracking system. When an administrator or user inputs a name for task assignment that contains malicious AngularJS template syntax, the backend fails to adequately sanitize this data before storing it in the database. Consequently, when other users subsequently view the issue details page where the assignee information is rendered, the browser interprets the stored payload as executable code rather than plain text. This behavior stems from a failure to escape special characters that are significant to AngularJS template parsing engines, allowing an attacker to inject arbitrary JavaScript payloads directly into the application's client-side rendering pipeline.
From a technical perspective, this vulnerability exploits the dynamic binding capabilities inherent in modern web frameworks like AngularJS. The flaw is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it aligns with CWE-83 regarding Stored XSS, where malicious scripts are permanently stored within target databases or application data structures. Unlike reflected XSS attacks that require user interaction to trigger a payload via URL manipulation, this vulnerability persists in the server-side storage and executes automatically upon page load for any authenticated user who accesses the affected record. The attacker leverages AngularJS interpolation syntax, typically denoted by double curly braces such as {{constructor.constructor('malicious_code')()}} or similar variants that bypass standard sanitization filters if they are not specifically tuned to detect template injection patterns. This allows the execution of arbitrary JavaScript in the context of the victim's session, effectively breaking the same-origin policy protections intended by web browsers.
The operational impact of this vulnerability is severe due to its stored nature and the high-privilege context often associated with project management tools like YouTrack. An authenticated attacker can craft a malicious assignee name that triggers when other team members view specific tickets. This enables session hijacking, where the attacker captures sensitive authentication tokens or cookies to impersonate legitimate users. It also facilitates data exfiltration, allowing the theft of confidential project details, source code snippets, or internal documentation displayed within the ticketing system. Furthermore, attackers can use this vector for phishing campaigns by redirecting victims to malicious external sites that mimic the YouTrack interface, thereby stealing credentials through social engineering techniques facilitated by the trusted domain context. In environments where multiple teams collaborate on sensitive projects, a single compromised account could lead to widespread compromise across all users who interact with the tainted tickets.
Mitigation strategies must focus on both immediate remediation and long-term defensive architecture improvements. The primary solution is to upgrade JetBrains YouTrack immediately to version 2026.2.18634 or later, where this specific input validation flaw has been patched by implementing stricter sanitization of assignee fields against AngularJS template injection patterns. For organizations unable to patch instantly due to operational constraints, a temporary workaround involves restricting the ability to modify assignee names to only highly trusted administrators and enforcing strict character set restrictions that exclude special symbols like curly braces which are essential for template execution. Additionally, implementing Content Security Policy headers with nonces or hashes can help mitigate the impact by preventing unauthorized script execution even if an injection occurs. Regular security audits focusing on input validation layers in web applications are crucial to prevent similar vulnerabilities arising from framework-specific parsing behaviors.
This incident highlights broader trends in application security regarding the risks of using client-side templating engines without robust server-side sanitization. It aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. Security teams should prioritize monitoring for unusual patterns in user input fields that contain template syntax markers as part of their intrusion detection systems. By understanding the mechanics of stored XSS through AngularJS injection, developers can better implement defense-in-depth strategies that include both frontend output encoding and backend validation rules to ensure data integrity and confidentiality across collaborative platforms.