{"id":"CVE-2026-123325","kind":"vulnerability","aliases":["CVE-2026-123325"],"related":[],"title":"JetBrains YouTrack: untrusted remote code runs through plugin sandbox page","description":"In JetBrains YouTrack before 2025.3.170763, \n2026.1.14150, \n2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page","summary":"Before the fixed builds, YouTrack allowed untrusted remote code to be included through its plugin sandbox page. An attacker who gets a user to reach that page can run code in the context of the YouTrack session.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","runtime","self-hosted","youtrack"],"not_affected_if":["already-patched","managed-hosting"],"how_to_check":"- Check the running YouTrack version against the fixed builds listed in the fix field.\n- Look at the YouTrack version under Administration > Global Settings or the About dialog: unknown if the sources do not say more.","fix":"- YouTrack `2025.3.170763` or later on the 2025.3 line\n- YouTrack `2026.1.14150` or later on the 2026.1 line\n- YouTrack `2026.2.19656` or later on the 2026.2 line","status":"open","published_at":"2026-11-06T11:17:12+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:42:11+00:00","updated_at":"2026-11-06T11:42:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T11:42:11Z","model":"claude-haiku-5-5","output":{"fix":"- YouTrack `2025.3.170763` or later on the 2025.3 line\n- YouTrack `2026.1.14150` or later on the 2026.1 line\n- YouTrack `2026.2.19656` or later on the 2026.2 line","reach":"unknown","title":"JetBrains YouTrack: untrusted remote code runs through plugin sandbox page","impact":"high","summary":"Before the fixed builds, YouTrack allowed untrusted remote code to be included through its plugin sandbox page. An attacker who gets a user to reach that page can run code in the context of the YouTrack session.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["youtrack","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"untrusted remote code runs inside the YouTrack application","analyst_note":"Check the JetBrains YouTrack release notes or advisory for the exact attack conditions, whether authentication is needed, and whether the plugin sandbox page is exposed by default.","how_to_check":"- Check the running YouTrack version against the fixed builds listed in the fix field.\n- Look at the YouTrack version under Administration > Global Settings or the About dialog: unknown if the sources do not say more.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","already-patched"],"who_is_affected":"Teams that self-host JetBrains YouTrack on a version earlier than the fixed builds are exposed. The sources do not say whether the plugin sandbox page is reachable by default, so unknown whether the default configuration is exposed. Hosted JetBrains cloud instances are handled by the vendor.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4206,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123325':13A,16A '-2026':12A,15A '2025.3.170763':64C '2026.1.14150':65C '2026.2.19656':66C 'allow':28B 'attack':41B 'build':26B 'code':5A,31B,52B,71C 'context':55B 'cve':11A,14A 'fix':25B 'get':43B 'host':21B 'includ':34B 'inclus':67C 'jetbrain':1A,17B,61C 'page':10A,39B,49B,78C 'plugin':8A,37B,76C 'possibl':73C 'reach':47B 'remot':4A,30B,70C 'run':6A,51B 'runtim':18B 'sandbox':9A,38B,77C 'self':20B 'self-host':19B 'session':59B 'untrust':3A,29B,69C 'user':45B 'via':74C 'youtrack':2A,22B,27B,58B,62C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host JetBrains YouTrack on a version earlier than the fixed builds are exposed. The sources do not say whether the plugin sandbox page is reachable by default, so unknown whether the default configuration is exposed. Hosted JetBrains cloud instances are handled by the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jetbrains","runtime","selfhosted","youtrack"],"campaign_type":null,"search_a":"'-123325':13A,16A '-2026':12A,15A 'code':5A 'cve':11A,14A 'jetbrain':1A 'page':10A 'plugin':8A 'remot':4A 'run':6A 'sandbox':9A 'untrust':3A 'youtrack':2A","search_b":"'allow':28B 'attack':41B 'build':26B 'code':31B,52B 'context':55B 'fix':25B 'get':43B 'host':21B 'includ':34B 'jetbrain':17B 'page':39B,49B 'plugin':37B 'reach':47B 'remot':30B 'run':51B 'runtim':18B 'sandbox':38B 'self':20B 'self-host':19B 'session':59B 'untrust':29B 'user':45B 'youtrack':22B,27B,58B","search_c":"'2025.3.170763':64C '2026.1.14150':65C '2026.2.19656':66C 'code':71C 'inclus':67C 'jetbrain':61C 'page':78C 'plugin':76C 'possibl':73C 'remot':70C 'sandbox':77C 'untrust':69C 'via':74C 'youtrack':62C","first_public_at":"2026-11-06T11:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123325","severity":null,"published_at":"2026-11-06T11:17:12+00:00","modified_at":"2026-11-06T11:17:12+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}