JetBrainsCVE-2026-86484

JetBrains YouTrack: template injection

Medium4.6CVE-2026-86484 · Published Sep 7, 2026 · updated Sep 8, 2026

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

JetBrains advisory

Affected versions

Package	Affected	Fixed in
YouTrack Product	< 2026.2.18634	2026.2.18634

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Sep 7	JetBrains IntelliJ IDEA: information disclosure Low3.3Sep 7 CVE-2026-865052026.2.2	Low3.3	2026.2.2
Sep 7	JetBrains GoLand: missing authentication Medium5.9Sep 7 CVE-2026-865062026.2.2.1	Medium5.9	2026.2.2.1
Sep 7	JetBrains YouTrack: information disclosure Medium6.8Sep 7 CVE-2026-864972026.2.18769	Medium6.8	2026.2.18769
Sep 7	JetBrains YouTrack: improper authorization High7.7Sep 7 CVE-2026-864982025.3.160480+1 more	High7.7	2025.3.160480+1 more
Sep 7	JetBrains YouTrack: missing authorization Medium4.3Sep 7 CVE-2026-864992026.1.14047	Medium4.3	2026.1.14047
Sep 7	In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user... Medium5.5Sep 7 CVE-2026-865002026.1.14047	Medium5.5	2026.1.14047

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.