JetBrains YouTrack: Stored cross-site scripting via Mermaid and LaTeX content
Summary
JetBrains YouTrack before 2026.2.19422 contains a stored cross-site scripting (XSS) vulnerability (CWE-79) in the handling of Mermaid and LaTeX content. An attacker can store script code in such content, which runs in the browser of users who view it, including administrators. The NVD vector (CVSS 8.1) requires no privileges but user interaction, such as opening a malicious issue or diagram, and it carries high impact on confidentiality and integrity. Exploitation is not known publicly, and CISA SSVC lists exploitation as none and not automatable.
Affected
- JetBrains YouTrack before 2026.2.19422 (CVE record: versions 0 to below 2026.2.19422)
- Affected versions of other release branches: Unknown.
Fixed in
- Fixed in JetBrains YouTrack 2026.2.19422 and later (per the sources reviewed).
- Fixed builds for older release branches: Unknown. Check the JetBrains Fixed Security Issues page.
Workaround
- Unverified: disable Mermaid and LaTeX content rendering in the YouTrack settings. This could not be confirmed in the JetBrains advisory, and no settings path was found.
Exploitation
- No public proof of concept or known exploitation found (ACN alert).
- CISA SSVC: Exploitation none, Automatable no.
- Not confirmed in the CISA KEV catalogue by this review.
Our recommendation
- Inventory all self-hosted YouTrack instances and their versions. JetBrains patches cloud instances.
- Upgrade self-hosted instances to 2026.2.19422 or later, or to the fixed build for your branch per the JetBrains page.
- If patching must wait, disable Mermaid and LaTeX rendering after confirming the setting in the JetBrains documentation.
- Restrict content creation and editing by external or guest users where possible, and review exposure of YouTrack to the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains Fixed Security Issues www.jetbrains.com
- ACN: Vulnerabilities in JetBrains products www.acn.gov.it
- Strix: CVE-2026-103493 www.strix.ai
- OpenCVE: CVE-2026-103493 app.opencve.io
- JetBrains YouTrack Markdown syntax documentation www.jetbrains.com
- CVEdetails: JetBrains YouTrack version list www.cvedetails.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:03.
Original description (NVD)
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.