CVE-2026-59791: JetBrains YouTrack XSS Vulnerability

CVE-2026-59791 Overview

CVE-2026-59791 is a CSS injection vulnerability affecting JetBrains YouTrack issue tracking software before version 2026.2.17012. The flaw resides in the Mermaid diagram rendering component, where user-controlled input is processed without adequate sanitization of style directives. An authenticated attacker can inject arbitrary Cascading Style Sheets (CSS) that render in another user's browser session. The issue is classified under [CWE-1021] (Improper Restriction of Rendered UI Layers or Frames) and requires user interaction to trigger. Exploitation impacts content integrity but does not directly expose sensitive data or affect availability.

Critical Impact
Attackers with low-privilege access can inject CSS through Mermaid diagrams to manipulate the visual presentation of YouTrack content, enabling UI redressing and potential clickjacking against other users.

Affected Products

JetBrains YouTrack versions prior to 2026.2.17012
YouTrack instances rendering Mermaid diagrams in issue descriptions or comments
Both self-hosted and cloud-hosted YouTrack deployments running vulnerable builds

Discovery Timeline

2026-07-10 - CVE-2026-59791 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-59791

Vulnerability Analysis

The vulnerability exists in the Mermaid diagram rendering pipeline within JetBrains YouTrack. Mermaid is a JavaScript-based diagramming and charting library that generates Scalable Vector Graphics (SVG) output from text definitions. YouTrack embeds this functionality to allow users to author flowcharts, sequence diagrams, and Gantt charts inside issue descriptions and comments.

When YouTrack processes Mermaid diagram source, it fails to strip or escape CSS style directives that a user can embed in the diagram definition. The rendered SVG or surrounding Hypertext Markup Language (HTML) inherits attacker-controlled style rules. These rules apply to the containing document, allowing manipulation of layout, visibility, and pointer behavior.

The scope is limited to CSS injection rather than full JavaScript execution. However, CSS-based attacks can exfiltrate limited data via attribute selectors and can facilitate UI redressing attacks against authenticated YouTrack users.

Root Cause

The root cause is insufficient sanitization of Mermaid diagram source before it reaches the browser rendering context. YouTrack accepts style-related tokens within diagram definitions and passes them through without enforcing an allowlist of safe CSS properties or a Content Security Policy strict enough to block inline style abuse.

Attack Vector

An authenticated attacker with permission to create or edit issues, comments, or wiki articles inserts a crafted Mermaid diagram containing malicious CSS. When a victim views the affected page, their browser renders the diagram and applies the injected styles. The attack requires the victim to open the compromised content, satisfying the user interaction requirement. Because the attack vector is network-based and only requires low privileges typical of YouTrack collaborators, it can spread across projects where issue viewing is broadly permitted.

No verified exploit code is publicly available. The vulnerability mechanism relies on abusing Mermaid's parsing of style directives, and technical specifics are outlined in the JetBrains Security Issues Fixed advisory.

Detection Methods for CVE-2026-59791

Indicators of Compromise

Mermaid diagram code blocks in YouTrack issues or comments containing style directives, classDef blocks with unusual CSS properties, or embedded <style> fragments
Unexpected visual changes to YouTrack pages, such as hidden elements, overlaid buttons, or altered link targets after viewing a specific issue
Audit log entries showing repeated edits to issue descriptions containing Mermaid syntax by low-privileged accounts

Detection Strategies

Review YouTrack content stores for Mermaid diagram definitions and flag entries that include CSS property names such as position, z-index, opacity, or content
Monitor Content Security Policy (CSP) violation reports from browsers accessing YouTrack for unexpected inline style events
Correlate YouTrack version information with the fixed build 2026.2.17012 to identify unpatched instances across the environment

Monitoring Recommendations

Enable and centralize YouTrack audit logs to track issue and comment modifications by user and timestamp
Instrument the reverse proxy or Web Application Firewall (WAF) in front of YouTrack to log request bodies containing Mermaid fenced code blocks for offline review
Alert on new or modified content from accounts that have not previously used Mermaid diagram syntax

How to Mitigate CVE-2026-59791

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.17012 or later on all self-hosted instances
Verify that YouTrack Cloud tenants are running the patched build and contact JetBrains support if uncertain
Audit recent issues, comments, and articles for Mermaid diagrams authored by low-privileged or newly created accounts

Patch Information

JetBrains addressed the CSS injection issue in YouTrack build 2026.2.17012. The fix hardens sanitization of Mermaid diagram input before rendering. Refer to the JetBrains Security Issues Fixed page for the authoritative advisory and upgrade guidance.

Workarounds

Restrict issue and comment creation permissions to trusted users until the patch is applied
Disable Mermaid diagram rendering in YouTrack configuration if the feature is not required for business workflows
Deploy a strict Content Security Policy at the reverse proxy layer to limit inline style execution against the YouTrack origin

bash

# Example: enforce a restrictive CSP header at an Nginx reverse proxy fronting YouTrack
add_header Content-Security-Policy "default-src 'self'; style-src 'self'; img-src 'self' data:; script-src 'self'; frame-ancestors 'none'" always;