JetBrains YouTrack versions prior to 2026.1.13162 allow a stored cross‑site scripting (XSS) vulnerability in project notification templates. The flaw enables attackers to inject malicious scripts that execute in the browsers of users who view affected notifications, potentially exposing sensitive data, hijacking sessions, or performing other client‑side attacks. This weakness is identified as CWE‑79.

JetBrains YouTrack before 2026.1.13162 is affected. No other vendors or versions are listed.

The CVSS score is 8.7, indicating high severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker submitting a malicious template via the YouTrack user interface, which is then stored and rendered for other users. Because the vulnerability requires access to the template editing feature, attackers must first depend on user credentials or compromised accounts with edit rights. Once a template is stored, any user who views it will be exposed to the injected script.