CVE-2026-103493
HighCVSS 8.1Summary
In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.
Risk Assessment
An attacker can execute malicious script in the victim's session context, potentially leading to data theft or account takeover. The risk affects all YouTrack users.
Recommendation
Update JetBrains YouTrack to version 2026.2.19422 or later. Check whether any malicious Mermaid/LaTeX content is already present in the system.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-103497Medium
In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.
- CVE-2026-103496Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.
- CVE-2026-103495Medium
In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.
- CVE-2026-103492Medium
In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.
- CVE-2026-103491Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.
- CVE-2026-103489Low
In JetBrains YouTrack before 2026.2.19422, HTML injection in VCS command failure notifications was possible.
- CVE-2026-103488High
In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues. The vulnerability enables bypassing access controls.
- CVE-2026-86478Critical
In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.
- CVE-2026-62422Critical
In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.
- CVE-2026-103494Medium
In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.
Original NVD description (English source)
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
Vulnerability data from NVD (NIST) · CISA KEV · EPSS