CVE-2026-49368: JetBrains YouTrack XSS Vulnerability

CVE-2026-49368 Overview

CVE-2026-49368 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions before 2026.1.13162. The flaw resides in project notification templates, where attacker-supplied input is rendered without proper sanitization. An authenticated user with project configuration privileges can inject malicious JavaScript that executes in the browsers of other users when notification templates are rendered. The vulnerability is tracked under CWE-79 and affects YouTrack's issue tracking and project management functionality.

Critical Impact
Stored JavaScript payloads execute in recipient browsers within the YouTrack session context, enabling session hijacking, credential theft, and unauthorized actions against the issue tracker.

Affected Products

JetBrains YouTrack versions prior to 2026.1.13162
YouTrack Server (self-hosted deployments)
YouTrack Cloud instances on the affected build chain

Discovery Timeline

2026-05-29 - CVE-2026-49368 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-49368

Vulnerability Analysis

The vulnerability is a stored XSS issue [CWE-79] in YouTrack's project notification template engine. Notification templates control the content of automated emails and in-app messages sent when issues change state, receive comments, or trigger workflow events. The template rendering path fails to sanitize or properly encode user-controlled fields before embedding them in HTML output. An attacker who can edit project notification templates persists a JavaScript payload that activates whenever a recipient views the rendered notification or related interface element. Because the payload runs in the authenticated YouTrack origin, it can read session cookies, issue API requests on behalf of the victim, and exfiltrate project data.

Root Cause

The root cause is missing output encoding in the notification template rendering pipeline. Template fields treat user input as trusted HTML rather than as text, allowing <script> tags and event handler attributes to survive into the final rendered document.

Attack Vector

Exploitation requires network access to the YouTrack instance, low privileges sufficient to modify project notification templates, and user interaction from a victim who must view the rendered notification. The scope is changed because the injected script executes in the victim's browser context rather than only affecting the attacker's session. The vulnerability does not affect availability.

No public proof-of-concept code is available for this issue. See the JetBrains Security Issues Fixed advisory for vendor-provided technical context.

Detection Methods for CVE-2026-49368

Indicators of Compromise

Project notification templates containing <script> tags, javascript: URIs, or HTML event handlers such as onerror, onload, or onmouseover.
Outbound network requests from user browsers to unfamiliar domains immediately after opening YouTrack notifications.
Unexpected modifications to notification template configurations in YouTrack audit logs.

Detection Strategies

Audit all project notification templates for HTML or script content using YouTrack's REST API and flag any template that contains markup beyond approved placeholders.
Inspect web server and reverse proxy logs for anomalous response sizes on notification-related endpoints, which may indicate injected payloads.
Correlate template edit events from YouTrack audit logs with subsequent authentication anomalies for users who received the notifications.

Monitoring Recommendations

Enable and centrally collect YouTrack audit logs for project administration actions, especially notification template changes.
Monitor browser security telemetry for Content Security Policy (CSP) violation reports originating from the YouTrack domain.
Track API tokens and session activity for accounts that received notifications from recently modified templates.

How to Mitigate CVE-2026-49368

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.1.13162 or later as published in the JetBrains Security Issues Fixed advisory.
Review the list of users with project administration rights and revoke unnecessary template editing privileges.
Inspect all existing notification templates and remove any embedded HTML or script content that did not originate from a trusted administrator.

Patch Information

JetBrains addressed CVE-2026-49368 in YouTrack 2026.1.13162. The fix enforces proper output encoding within project notification template rendering. Customers running YouTrack Cloud receive the patch automatically; self-hosted YouTrack Server administrators must apply the update manually. Refer to the JetBrains Security Issues Fixed page for the official release details.

Workarounds

Restrict project administrator permissions to a minimal set of trusted users until the patch is applied.
Deploy a strict Content Security Policy on the YouTrack instance to limit inline script execution and reduce XSS impact.
Manually sanitize or reset suspect notification templates to known-good defaults pending the upgrade.

bash

# Verify the running YouTrack version against the patched release
curl -s -H "Authorization: Bearer $YOUTRACK_TOKEN" \
  "https://youtrack.example.com/api/config?fields=version"

# Expected output should report version 2026.1.13162 or later