CSS Injection Vulnerability in JetBrains YouTrack Software
CVE-2026-123850

3.5LOW

Key Information:

Vendor

Jetbrains
Status
Youtrack
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123850?

In JetBrains YouTrack versions earlier than 2026.2.19422, a CSS injection vulnerability exists that can be exploited through configuration directives in Mermaid diagrams. This issue could allow attackers to inject malicious CSS code, potentially compromising the integrity and security of the application by manipulating the appearance or behavior of the diagrams displayed.

Affected Version(s)

YouTrack 0 < 2026.2.19422

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.