CVE-2026-100275: XSS
Published Sep 30, 2026
·Updated
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
Affected Software
1 affected component
JetBrains YouTrack<2026.2.19197
Event History
Sep 30, 2026
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and interaction are required to exploit this issue?
The CVSS vector indicates that an attacker needs high privileges and that user interaction is required. The attack can be performed over the network with low attack complexity.
2
Which deployments are affected?
JetBrains YouTrack versions before 2026.2.19197 are affected. The provided information does not specify configuration prerequisites or whether the vulnerable workflow error notification toast is enabled by default.
3
What is the likely impact if exploitation succeeds?
The issue is stored cross-site scripting in a workflow error notification toast. The CVSS vector rates confidentiality impact as high, integrity impact as low, and availability impact as none, with scope changed.