CVE-2026-49368: In JetBrains YouTrack before 2026

Synopsis

This is a stored cross-site scripting (XSS) bug in JetBrains YouTrack, where malicious script content can be saved into project notification templates and later rendered in another user's browser session. The flaw is reachable over the network and requires a low-privilege YouTrack account plus a victim who views the affected notification, after which the attacker's script runs in the victim's session and can read or tamper with YouTrack content the victim can access. A patched-image rebuild at 2026.1.13162 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the YouTrack web interface over the network to plant the malicious template content.

• AuthenticationRequired

  A low-privilege YouTrack account with permission to edit project notification templates is sufficient; no admin role is needed.

• Victim interactionRequired

  Exploitation fires when a separate YouTrack user views or receives the rendered notification containing the injected script.

• Attack complexityDetail

  Attack complexity is low: the stored payload triggers reliably whenever the notification is rendered, with no race or environmental dependency.

Blast Radius

• Executes attacker-controlled JavaScript in the victim's authenticated YouTrack session, reading issues, comments, and project data the victim can see.
• Performs actions as the victim, including modifying issues, comments, or notification templates, which can be used to pivot to additional users.
• Can exfiltrate session tokens or other browser-accessible credentials tied to the YouTrack origin, enabling continued access without re-exploitation.