JetBrains YouTrack allows the inclusion of Mermaid diagrams through configuration directives, and a vulnerability exists that permits the injection of arbitrary CSS styles. This CSS injection can change the appearance of the interface, potentially mislead users, deface the UI, or surface information by manipulating display properties. The impact is limited to visual and informational compromise rather than direct code execution, which aligns with the low CVSS score of 3.5.

Any JetBrains YouTrack instance running a version older than 2026.2.19422 is affected. No other vendor or product variant is currently listed as impacted.

The CVSS score of 3.5 indicates low overall severity, and the EPSS score is not available, suggesting there is no strongly reported exploitation activity. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is an attacker with the ability to modify configuration directives that include Mermaid diagrams—this could be an administrator or a user with write access to configuration files. If such access is indirectly exposed via a web interface or API, exploitation is possible. Due to the nature of the flaw, successful injection would not grant arbitrary code execution but could lead to UI manipulation, phishing, or information disclosure through crafted styles.