Stored XSS in JetBrains YouTrack Workflow Error Notification
CVE-2026-100275

6.9MEDIUM

Key Information:

Vendor

Jetbrains
Status
Youtrack
Vendor
CVE Published:
30 September 2026

What is CVE-2026-100275?

In JetBrains YouTrack versions before 2026.2.19197, a stored Cross-Site Scripting vulnerability was identified, allowing attackers to inject malicious scripts into workflow error notification toasts. This vulnerability could potentially lead to the execution of arbitrary scripts in the context of the affected users, significantly compromising their session and sensitive information. Users are urged to update to the patched version to protect against potential exploitation.

Affected Version(s)

YouTrack 0 < 2026.2.19197

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.