Inclusion of Functionality from Untrusted Control Sphere in YouTrack - CVE-2026-123325
Published: November 6, 2026
Vulnerability identifier: #VU159676
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123325
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute untrusted remote code through the plugin sandbox page.
The vulnerability exists due to inclusion of code from an untrusted source in the plugin sandbox page when loading remote code. A remote attacker can supply untrusted remote code for inclusion to execute it in the affected page's context.
Affected software
YouTrack
How to mitigate CVE-2026-123325
Install security update from vendor's website.
YouTrack - addressed in versions 2025.3.170763, 2026.1.14150, 2026.2.19656