Description
In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
Published: 2026-11-06
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

In JetBrains YouTrack, versions before 2025.3.170763, 2026.1.14150, and 2026.2.19656 allow inclusion of untrusted remote code through the plugin sandbox page. This flaw enables an attacker to execute arbitrary code, potentially compromising confidentiality, integrity, and availability. The weakness corresponds to CWE-829.

Affected Systems

JetBrains YouTrack installations running any of the vulnerable versions listed above are impacted. All deployed instances that have not yet upgraded to 2025.3.170763 or the newer 2026.x releases are at risk.

Risk and Exploitability

The CVSS score of 7.1 classifies this as a high‑severity issue, while the EPSS score is not available, making precise exploitation probability uncertain. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves delivering malicious code through the web‑based plugin sandbox page; authentication requirements are not explicitly stated, so this inference remains tentative.

Generated by OpenCVE AI on November 6, 2026 at 11:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update JetBrains YouTrack to at least 2025.3.170763 or later 2026.1.14150/2026.2.19656, whichever is the newest stable release.
  • Disable or restrict network access to the plugin sandbox page via firewall or reverse‑proxy rules if the feature is not required.
  • Enforce strict administrative controls so that only trusted personnel can enable or modify plugins, and monitor for unexpected plugin changes.

Generated by OpenCVE AI on November 6, 2026 at 11:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains youtrack
Vendors & Products Jetbrains
Jetbrains youtrack

Fri, 06 Nov 2026 12:00:00 +0000

Type Values Removed Values Added
Title Untrusted Remote Code Inclusion via Plugin Sandbox Page in JetBrains YouTrack

Fri, 06 Nov 2026 10:30:00 +0000

Type Values Removed Values Added
Description In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
Weaknesses CWE-829
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N'}

Subscriptions

Jetbrains Youtrack
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published:

Updated: 2026-11-06T10:28:07.616Z

Reserved: 2026-11-05T18:38:29.109Z

Link: CVE-2026-123325

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T11:17:12.530

Modified: 2026-11-06T11:17:12.530

Link: CVE-2026-123325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T12:15:02Z

Weaknesses
  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere