JetBrainsCVE-2026-61492

JetBrains YouTrack: cross-site scripting

Low3.5CVE-2026-61492 · Published Jul 10, 2026

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

JetBrains advisory

Affected versions

Package	Affected	Fixed in
YouTrack Product	< 2026.2.17394	2026.2.17394

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Jul 10	JetBrains YouTrack: clickjacking Low3.5Jul 10 CVE-2026-597912026.2.17012	Low3.5	2026.2.17012
Jul 10	JetBrains IntelliJ IDEA: code execution via path traversal Critical9.6Jul 10 CVE-2026-597922026.1.4+1 more	Critical9.6	2026.1.4+1 more
Jul 10	In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via... High8.8Jul 10 CVE-2026-597932026.1.2	High8.8	2026.1.2
Jul 10	JetBrains TeamCity: cross-site scripting High7.3Jul 10 CVE-2026-597942026.1.2	High7.3	2026.1.2
Jul 10	JetBrains TeamCity: cross-site scripting High8.1Jul 10 CVE-2026-597952026.1.2	High8.1	2026.1.2
Jul 10	JetBrains TeamCity: insecure permissions High8.1Jul 10 CVE-2026-597962026.1.2	High8.1	2026.1.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.