{"id":"CVE-2026-123850","kind":"vulnerability","aliases":["CVE-2026-123850"],"related":[],"title":"JetBrains YouTrack: CSS injection through Mermaid diagram configuration directives","description":"In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives","summary":"Before version 2026.2.19422, YouTrack let CSS be injected into Mermaid diagrams through configuration directives. An attacker who can get a crafted diagram rendered could alter how the page looks, with limited impact beyond that.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","self-hosted","vendor","youtrack"],"not_affected_if":["mermaid-diagrams-unused","youtrack-cloud"],"how_to_check":"- Check the YouTrack version in the admin settings or About page; versions before `2026.2.19422` are affected.","fix":"- YouTrack: move to `2026.2.19422` or later.","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:44+00:00","updated_at":"2026-11-06T17:45:44+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T17:45:44Z","model":"claude-haiku-5-5","output":{"fix":"- YouTrack: move to `2026.2.19422` or later.","reach":"network","title":"JetBrains YouTrack: CSS injection through Mermaid diagram configuration directives","impact":"low","summary":"Before version 2026.2.19422, YouTrack let CSS be injected into Mermaid diagrams through configuration directives. An attacker who can get a crafted diagram rendered could alter how the page looks, with limited impact beyond that.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["youtrack","self-hosted","jetbrains"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Page styling altered by injected CSS in diagrams","analyst_note":"","how_to_check":"- Check the YouTrack version in the admin settings or About page; versions before `2026.2.19422` are affected.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["youtrack-cloud","mermaid-diagrams-unused"],"who_is_affected":"Teams that self-host JetBrains YouTrack with Mermaid diagrams enabled in issues or articles. The sources do not say whether hosted YouTrack Cloud instances were patched by the vendor already.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000657,"input_tokens":4177,"output_tokens":479,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123850':12A,15A '-2026':11A,14A '2026.2.19422':24B,59C 'alter':46B 'attack':37B 'beyond':54B 'configur':8A,34B,68C 'could':45B 'craft':42B 'css':3A,27B,60C 'cve':10A,13A 'diagram':7A,32B,43B,66C 'direct':9A,35B,69C 'get':40B 'host':19B 'impact':53B 'inject':4A,29B,61C 'jetbrain':1A,16B,56C 'let':26B 'limit':52B 'look':50B 'mermaid':6A,31B,65C 'page':49B 'possibl':63C 'render':44B 'self':18B 'self-host':17B 'vendor':20B 'version':23B 'via':67C 'youtrack':2A,21B,25B,57C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host JetBrains YouTrack with Mermaid diagrams enabled in issues or articles. The sources do not say whether hosted YouTrack Cloud instances were patched by the vendor already.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","low","selfhosted","vendor","youtrack"],"campaign_type":null,"search_a":"'-123850':12A,15A '-2026':11A,14A 'configur':8A 'css':3A 'cve':10A,13A 'diagram':7A 'direct':9A 'inject':4A 'jetbrain':1A 'mermaid':6A 'youtrack':2A","search_b":"'2026.2.19422':24B 'alter':46B 'attack':37B 'beyond':54B 'configur':34B 'could':45B 'craft':42B 'css':27B 'diagram':32B,43B 'direct':35B 'get':40B 'host':19B 'impact':53B 'inject':29B 'jetbrain':16B 'let':26B 'limit':52B 'look':50B 'mermaid':31B 'page':49B 'render':44B 'self':18B 'self-host':17B 'vendor':20B 'version':23B 'youtrack':21B,25B","search_c":"'2026.2.19422':59C 'configur':68C 'css':60C 'diagram':66C 'direct':69C 'inject':61C 'jetbrain':56C 'mermaid':65C 'possibl':63C 'via':67C 'youtrack':57C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123850","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}