CVE-2025-54527: JetBrains YouTrack XSS Vulnerability

CVE-2025-54527 Overview

CVE-2025-54527 affects JetBrains YouTrack, an issue tracking and project management platform. The vulnerability stems from improper iframe configuration in the widget sandbox. Popups spawned from widgets can bypass the sandbox security restrictions intended to isolate untrusted widget content from the parent application.

The flaw is classified under [CWE-1021] (Improper Restriction of Rendered UI Layers or Frames). Exploitation requires user interaction and a network-based attack vector. Affected versions include YouTrack builds prior to 2025.2.86935, 2025.2.87167, 2025.3.87341, and 2025.3.87344.

Critical Impact
A crafted widget can escape sandbox restrictions through popups, enabling limited confidentiality and integrity impact against authenticated YouTrack users who interact with malicious widget content.

Affected Products

JetBrains YouTrack versions prior to 2025.2.86935
JetBrains YouTrack versions prior to 2025.2.87167
JetBrains YouTrack versions prior to 2025.3.87341 and 2025.3.87344

Discovery Timeline

2025-07-28 - CVE-2025-54527 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54527

Vulnerability Analysis

YouTrack supports extensibility through widgets rendered inside iframes. These iframes rely on the HTML sandbox attribute to restrict what widget content can do. Sandbox restrictions typically block script execution, form submission, navigation of the top-level browsing context, and popups.

In the affected versions, the sandbox configuration for widget iframes does not properly govern popups created by widget content. A popup opened from within the widget iframe can escape the sandbox restrictions applied to its parent frame. The escaped popup then operates without the intended isolation constraints, expanding the attack surface available to a malicious widget author.

The issue tracks with [CWE-1021], covering cases where UI layer or frame restrictions are inadequate. Impact remains scoped to confidentiality and integrity at low severity, with no availability impact recorded.

Root Cause

The sandbox iframe configuration omits the necessary restrictions on allow-popups-to-escape-sandbox. When popups inherit or exceed the permissions of the parent sandbox, the isolation model breaks. This allows widget-originated popups to render content and execute behavior outside the sandbox boundary that YouTrack expects to enforce.

Attack Vector

An attacker with the ability to publish or embed a widget in a YouTrack instance can craft widget content that opens a popup. The popup escapes the sandbox and can present spoofed content, perform phishing against the authenticated session, or interact with the browsing context in ways the sandbox was designed to prevent. Exploitation requires a victim user to interact with the malicious widget or the popup it spawns. The scope changes because the impact extends beyond the initial iframe boundary.

No public proof-of-concept or exploit code is available for CVE-2025-54527. Refer to the JetBrains Security Issues Fixed advisory for vendor-supplied technical context.

Detection Methods for CVE-2025-54527

Indicators of Compromise

Unexpected popup windows originating from YouTrack widget iframes during normal user workflows.
Widget content referencing external domains or authentication endpoints not aligned with organizational integrations.
Browser console warnings about sandbox escapes or blocked navigation attempts tied to YouTrack widget frames.

Detection Strategies

Review YouTrack audit logs for recently installed, modified, or imported widgets, particularly from untrusted authors.
Monitor web proxy and DNS logs for outbound requests generated by YouTrack browser sessions to unfamiliar domains coincident with widget usage.
Inspect the Content-Security-Policy and iframe sandbox headers served by the YouTrack instance to confirm the patched configuration is in effect.

Monitoring Recommendations

Alert on new widget installations by non-administrative users and require review before publication.
Track user reports of unexpected login prompts or dialogs appearing inside YouTrack sessions, which may indicate phishing via escaped popups.
Correlate YouTrack server access logs with browser telemetry to identify anomalous widget rendering patterns.

How to Mitigate CVE-2025-54527

Immediate Actions Required

Upgrade JetBrains YouTrack to build 2025.2.86935, 2025.2.87167, 2025.3.87341, or 2025.3.87344 or later, matching your release track.
Audit installed widgets and remove any from untrusted or unknown sources until the upgrade completes.
Restrict widget installation privileges to trusted administrators only.

Patch Information

JetBrains addressed the improper iframe sandbox configuration in YouTrack builds 2025.2.86935, 2025.2.87167, 2025.3.87341, and 2025.3.87344. Consult the JetBrains Security Issues Fixed page for release notes and download links. YouTrack Cloud instances are patched by JetBrains directly. Self-hosted YouTrack Server administrators must apply the update manually.

Workarounds

Remove or disable third-party widgets until the patch is applied.
Enforce browser-level popup blocking policies for users accessing YouTrack.
Apply Content-Security-Policy headers at the reverse proxy to further constrain frame and popup behavior where feasible.

bash

# Verify installed YouTrack version before and after upgrade
curl -s https://<youtrack-host>/api/config | jq '.version'

# Example: restrict widget install permission via YouTrack REST API
curl -X POST "https://<youtrack-host>/api/admin/globalSettings/appSettings" \
  -H "Authorization: Bearer <perm-token>" \
  -H "Content-Type: application/json" \
  -d '{"allowWidgetInstallForAllUsers": false}'