CVE-2026-86483: XSS
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
Affected Software
Event History
Frequently Asked Questions
Which YouTrack instances should be prioritized for remediation?
Instances running a version earlier than 2026.2.18634 are affected. Exposure requires network access to the YouTrack instance and use of Agile board cards with custom fields.
What does an attacker need to exploit this issue?
The attacker needs low-level privileges to create or modify the relevant custom-field content. A user must then interact with the malicious content for the XSS payload to execute.
What is the expected impact if exploitation succeeds?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. The scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.
What is the remediation?
Upgrade JetBrains YouTrack to version 2026.2.18634 or later. The provided data does not identify a configuration workaround or a method to determine whether exploitation has already occurred.