CVE-2026-123850
Full vulnerability record from the local CVENow database.
Description
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
Severity
LOW
CVSS score
3.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-11-06 17:17:24
Last modified
2026-11-06 20:20:05.730000
View original CVE JSON
{
"id": "CVE-2026-123850",
"sourceIdentifier": "[email protected]",
"published": "2026-11-06T17:17:24.000",
"lastModified": "2026-11-06T20:20:05.730",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "JetBrains",
"product": "YouTrack",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2026.2.19422",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 3.5,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T16:40:42.373709Z",
"id": "CVE-2026-123850",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-1021"
}
]
}
],
"references": [
{
"url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
"source": "[email protected]"
}
]
}