CVE-2026-86484: XSS
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to set or modify an assignee name, because the injected content is stored in that field. Exploitation also requires a user to view the affected rendered content.
Which deployments are affected?
JetBrains YouTrack versions before 2026.2.18634 are affected. The available information does not state whether any particular default configuration exposes the vulnerable rendering path.
What should teams do if they cannot upgrade immediately?
The provided information does not identify a vendor workaround. Until upgrading, restrict who can create or modify assignee names and treat existing assignee-name content as potentially untrusted.
How can administrators check for possible exposure?
Review assignee names for unexpected AngularJS template expressions or script-like content, especially values created or changed by lower-privileged users. The issue is stored XSS, so suspicious values may persist until removed.