A stored cross‑site scripting flaw exists in the workflow error notification toast of JetBrains YouTrack prior to 2026.2.19197. Malicious content can be persisted in the notification, allowing it to execute arbitrary JavaScript when a user views the error toast. This can lead to session hijacking, credential theft, or other client‑side attacks against users who have permissions to view the notification.

JetBrains YouTrack versions earlier than 2026.2.19197 are affected.

The CVSS score of 6.9 indicates a moderate severity. Exploitation is likely to require an attacker to inject the payload through a workflow that triggers an error notification, meaning the attacker needs sufficient privileges to create or modify that workflow. No current evidence of active exploitation is recorded, and the vulnerability is not listed in the CISA KEV catalog.