An attacker can send an HTTP request to JetBrains YouTrack with a malicious User‑Agent header. The application stores the header value without sanitisation and later displays it in the web interface, enabling stored cross‑site scripting (XSS). An attacker could inject arbitrary HTML or JavaScript that executes in the browsers of any user who views the affected content, potentially compromising credentials, defacing the site, or executing further attacks. The vulnerability is classified as CWE‑79.

JetBrains YouTrack installations running any version prior to 2026.2.18991 are affected. No specific sub‑versions are listed, so all releases older than or equal to 2026.2.18890 are presumed vulnerable.

The CVSS score of 4.7 indicates moderate risk. EPSS is not available, and the vulnerability has not been listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The likely attack vector is an unauthenticated or authenticated HTTP request directed at the server; the malicious User‑Agent is then stored and rendered when the data is displayed. Given the moderate severity and lack of known exploitation, the risk is moderate, but organisations that expose YouTrack to the internet or host sensitive data should assess the potential impact before deploying the vulnerability to live workloads.