CVE-2026-86484: JetBrains YouTrack XSS Vulnerability

CVE-2026-86484 Overview

CVE-2026-86484 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions prior to 2026.2.18634. The flaw stems from AngularJS template injection in assignee names, allowing an authenticated user to inject expressions that execute in the browser context of other users viewing affected issues. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction and low-level privileges, and the impact is limited to confidentiality and integrity within the victim's session.

Critical Impact
Authenticated attackers can inject AngularJS template expressions through assignee name fields, resulting in stored XSS that executes in the browsers of other YouTrack users.

Affected Products

JetBrains YouTrack versions before 2026.2.18634
YouTrack self-hosted and cloud instances running vulnerable builds
YouTrack issue tracker rendering AngularJS-processed assignee names

Discovery Timeline

2026-09-07 - CVE-2026-86484 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86484

Vulnerability Analysis

The vulnerability resides in how YouTrack renders assignee name values through the AngularJS templating engine. AngularJS evaluates expressions written in double curly braces within bound scopes, and when user-controlled strings are passed into a scope without sanitization, those strings are interpreted as template expressions rather than literal text. An attacker with permission to create or modify user or assignee data can plant an expression that executes JavaScript when other users view the affected view.

The stored nature of the flaw means the payload persists in the YouTrack database. Every user who subsequently loads an issue, board, or list displaying the malicious assignee triggers execution. The impact scope is limited to the affected user's session because AngularJS sandbox escapes constrain the payload to browser context rather than server compromise.

Root Cause

The root cause is unsafe interpolation of user-supplied assignee names inside AngularJS-bound templates. YouTrack passed raw input into the template rendering pipeline without escaping or disabling expression evaluation on that field.

Attack Vector

Exploitation is network-based and requires an authenticated account with permissions to set assignee metadata. A victim must load a YouTrack view containing the malicious assignee for the payload to fire. The attacker submits an AngularJS expression as an assignee name. When the record is rendered, AngularJS evaluates the expression and executes attacker-controlled script in the victim's browser context. Consult the JetBrains Security Issues Fixed advisory for vendor details.

Detection Methods for CVE-2026-86484

Indicators of Compromise

Assignee name fields containing AngularJS interpolation syntax such as {{ and }} or constructor chain expressions
Unexpected outbound requests from user browsers to attacker-controlled domains following YouTrack page loads
Session tokens or CSRF tokens appearing in web server logs of external hosts referenced from YouTrack sessions
Audit log entries showing assignee modifications by low-privilege accounts followed by mass issue views

Detection Strategies

Inspect the YouTrack database and audit logs for assignee or user display name values containing template delimiters or JavaScript keywords
Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating on YouTrack domains
Correlate authenticated YouTrack sessions against unusual DOM-based network calls using web proxy telemetry

Monitoring Recommendations

Enable YouTrack audit logging and forward events to a centralized SIEM for review of privilege changes and metadata edits
Alert on version banner responses from YouTrack instances still reporting builds below 2026.2.18634
Track anomalous JavaScript execution or cookie access originating from YouTrack pages in endpoint browser telemetry

How to Mitigate CVE-2026-86484

Immediate Actions Required

Upgrade all JetBrains YouTrack instances to version 2026.2.18634 or later
Audit existing assignee, user, and group display name fields for template-injection payloads and sanitize any offending records
Review recent account provisioning and permission grants that allow modification of assignee metadata

Patch Information

JetBrains addressed the issue in YouTrack build 2026.2.18634. Refer to the JetBrains Security Issues Fixed page for the official fix reference and version guidance. Self-hosted administrators should follow standard YouTrack upgrade procedures, while YouTrack Cloud tenants receive the fix automatically.

Workarounds

Restrict permissions for creating or renaming users and assignees to trusted administrators until patching is complete
Enforce a strict Content Security Policy that blocks inline script execution on YouTrack origins to reduce payload impact
Temporarily disable AngularJS-rendered custom fields that accept free-form user input where feasible

bash

# Example: verify installed YouTrack build against the fixed version
curl -s https://youtrack.example.com/api/config | jq '.version'
# Expected output: "2026.2.18634" or later