CVE-2026-123850: Security vulnerability

Published Nov 6, 2026

Updated

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains YouTrack to a version that resolves this vulnerability.
Fixed in 2026.2.19422

Event History

Nov 6, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input must an attacker control to exploit this issue?

The attacker needs to supply Mermaid diagram content containing configuration directives. The available data does not specify whether this can be done by any authenticated user or requires additional permissions.

Which deployments are affected?

JetBrains YouTrack versions before 2026.2.19422 are affected. The data does not state whether Mermaid diagrams or configuration directives are enabled by default.

What is the remediation?

Upgrade JetBrains YouTrack to version 2026.2.19422 or later. No alternative mitigation is provided in the available data.

CVE-2026-123850: Security vulnerability

Remediation

Event History

Frequently Asked Questions

What input must an attacker control to exploit this issue?

Which deployments are affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

What input must an attacker control to exploit this issue?

Which deployments are affected?

What is the remediation?