The vulnerability is a prototype pollution flaw in the websandbox bridge of JetBrains YouTrack before 2026.2.16593. An attacker can alter the prototypes of core JavaScript objects through crafted input, leading to unintended behavior or leaks. This weakness is classified as CWE‑1321.

Affected systems are JetBrains YouTrack installations running any version earlier than 2026.2.16593. No other products or major patches are listed. The vulnerability does not affect related services beyond the embedded websandbox component.

The CVSS score of 2.6 indicates low severity, and the EPSS score is not available, so known exploitation activity cannot be confirmed. The vulnerability appears to require an attacker to supply malicious data to the websandbox bridge, which could be achieved by exploiting other web application weakness or through insecure configuration. Since it is not listed in the CISA Known Exploited Vulnerabilities catalog, there is currently no evidence of active exploitation.