CVE-2026-86491: JetBrains YouTrack Stored XSS Vulnerability

CVE-2026-86491 Overview

CVE-2026-86491 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions prior to 2026.2.18634. The flaw allows authenticated users with elevated privileges to inject persistent JavaScript payloads through project and organization icon uploads. When other users view affected projects or organizations, the injected script executes in their browser context. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Stored JavaScript payloads execute in the browser sessions of legitimate users, enabling limited data disclosure and integrity impact within the YouTrack application context.

Affected Products

• JetBrains YouTrack versions prior to 2026.2.18634
• YouTrack project icon upload functionality
• YouTrack organization icon upload functionality

Discovery Timeline

• 2026-09-07 - CVE-2026-86491 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86491

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of files uploaded as project and organization icons in JetBrains YouTrack. Attackers with the necessary permissions can upload a crafted file that YouTrack later renders in a way that permits script execution. Because the payload is stored server-side and served to other users, exploitation persists across sessions until the malicious icon is removed.

Exploitation requires high privileges and user interaction, which limits the attacker population. However, the persistent nature of stored XSS means the payload triggers automatically each time a victim loads a page displaying the affected icon.

Root Cause

The root cause is improper neutralization of file content or metadata associated with icon uploads. YouTrack accepts icon files without adequately validating their content type or stripping executable script content before rendering. Files such as SVG documents can carry embedded <script> elements that browsers execute when the file is served with an active content type.

Attack Vector

An authenticated user with permission to modify project or organization settings uploads a malicious icon file. The server stores the file and associates it with the project or organization profile. When any authorized user browses to the affected resource, the browser renders the icon and executes the embedded JavaScript. The script runs under the victim's YouTrack session, allowing actions such as reading page content, exfiltrating tokens accessible to the DOM, or performing requests on the victim's behalf.

Because no verified public proof-of-concept is available, refer to the JetBrains Privacy and Security Issues Fixed advisory for authoritative technical details.

Detection Methods for CVE-2026-86491

Indicators of Compromise

• Icon files stored in YouTrack with content types such as image/svg+xml that contain <script>, onload, or onerror attributes
• Unexpected outbound HTTP requests originating from user browsers immediately after loading YouTrack project or organization pages
• Recent icon upload events in YouTrack audit logs performed by accounts that do not routinely modify branding assets

Detection Strategies

• Review YouTrack audit logs for icon upload events and correlate the uploading account against expected administrative activity
• Scan stored project and organization icon files for embedded scripting content, focusing on SVG payloads
• Inspect browser Content Security Policy violation reports for inline script executions on YouTrack pages

Monitoring Recommendations

• Enable and forward YouTrack administrative and audit logs to a centralized logging platform for retention and search
• Alert on modifications to project or organization icons performed outside of change-management windows
• Monitor for anomalous session behavior such as unexpected API calls originating from browser sessions viewing YouTrack pages

How to Mitigate CVE-2026-86491

Immediate Actions Required

• Upgrade JetBrains YouTrack to version 2026.2.18634 or later
• Audit all existing project and organization icons and remove any that contain embedded script content
• Review the permission model for project and organization administration and revoke unnecessary elevated privileges

Patch Information

JetBrains resolved the issue in YouTrack 2026.2.18634. Refer to the JetBrains Privacy and Security Issues Fixed page for release notes and upgrade guidance. Both self-hosted YouTrack Server and YouTrack Cloud customers should confirm they are running the fixed build.

Workarounds

• Restrict icon upload permissions to a minimal set of trusted administrators until patching is complete
• Configure a strict Content Security Policy that blocks inline script execution on YouTrack pages where feasible
• Temporarily block the upload of SVG files at a reverse proxy or web application firewall if immediate patching is not possible

# Example WAF rule to block SVG uploads to YouTrack icon endpoints
# (adapt endpoint paths to your deployment)
SecRule REQUEST_URI "@rx /api/admin/(projects|organizations)/.+/icon" \
  "id:1008649,phase:2,deny,status:415,\
   chain,msg:'Block SVG icon upload - CVE-2026-86491'"
  SecRule REQUEST_HEADERS:Content-Type "@contains svg"