JetBrainsCVE-2026-86483

JetBrains YouTrack: cross-site scripting

Medium5.4CVE-2026-86483 · Published Sep 7, 2026 · updated Sep 8, 2026

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

JetBrains advisory

Affected versions

Package	Affected	Fixed in
YouTrack Product	< 2026.2.18634	2026.2.18634

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Sep 7	JetBrains IntelliJ IDEA: information disclosure Low3.3Sep 7 CVE-2026-865052026.2.2	Low3.3	2026.2.2
Sep 7	JetBrains GoLand: missing authentication Medium5.9Sep 7 CVE-2026-865062026.2.2.1	Medium5.9	2026.2.2.1
Sep 7	JetBrains YouTrack: information disclosure Medium6.8Sep 7 CVE-2026-864972026.2.18769	Medium6.8	2026.2.18769
Sep 7	JetBrains YouTrack: improper authorization High7.7Sep 7 CVE-2026-864982025.3.160480+1 more	High7.7	2025.3.160480+1 more
Sep 7	JetBrains YouTrack: missing authorization Medium4.3Sep 7 CVE-2026-864992026.1.14047	Medium4.3	2026.1.14047
Sep 7	In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user... Medium5.5Sep 7 CVE-2026-865002026.1.14047	Medium5.5	2026.1.14047

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.