In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
The issue affects JetBrains YouTrack versions before 2025.3.170763, 2026.1.14150, and 2026.2.19656. Upgrade to the applicable fixed release or a later version.
The CVSS vector indicates that exploitation can be performed over the network with low attack complexity and requires no privileges. It also requires user interaction.
Successful exploitation may allow inclusion of untrusted remote code through the plugin sandbox page. The reported impact includes high integrity impact and low confidentiality impact, with no availability impact.