JetBrains YouTrack plugin sandbox page allows untrusted remote code inclusion
An outside malicious program could get into your team's issue tracker.
Summary
The plugin sandbox page in JetBrains YouTrack could include untrusted remote code. Users of YouTrack before the fixed versions are affected.
What to do
Update to the fixed version for your line: 2025.3.170763, 2026.1.14150, or 2026.2.19656. See the JetBrains advisory for details.
Update to at least the version for your product:
- JetBrains YouTrack 2025.3 2025.3.170763 or later
- JetBrains YouTrack 2026.1 2026.1.14150 or later
- JetBrains YouTrack 2026.2 2026.2.19656 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen