CVE-2026-59791: JetBrains YouTrack CSS Injection in Mermaid Diagrams – Patch 2026.2.17012

Technical summary

CVE-2026-59791 is a CSS injection flaw (CWE-1021) in YouTrack's Mermaid diagram rendering pipeline. The vulnerability arises when user-supplied CSS is not properly sanitized before being applied to diagram elements. An authenticated user can embed malicious CSS in a Mermaid diagram definition, which executes in the browser context of other users viewing that diagram. The attack requires the attacker to have valid authentication credentials and depends on the victim clicking or viewing the malicious diagram, limiting the practical scope.

Business impact

While the risk score is low, CSS injection can enable social engineering attacks or phishing campaigns by allowing attackers to modify the visual presentation of YouTrack content. An attacker with account access could create misleading diagrams, inject fake instructions, or craft visually convincing fake authentication prompts. For organizations using YouTrack for critical workflow documentation or project tracking, such defacement could erode trust in the system and require time to remediate and audit affected diagrams.

Affected systems

JetBrains YouTrack instances running versions before 2026.2.17012 are affected. The vulnerability is specific to the Mermaid diagram rendering component and only impacts users who interact with diagrams created or modified by authenticated attackers. On-premises and cloud-hosted YouTrack deployments are both vulnerable if not updated.

Exploitability

Exploitability is low to moderate in practice. The attack requires a valid YouTrack user account (elevated barrier for external attackers), relies on victim interaction (viewing the diagram), and produces no authentication bypass or data exfiltration. An insider with legitimate access poses the primary risk. No publicly known exploitation in the wild is tracked by CISA KEV at this time.

Remediation

Upgrade JetBrains YouTrack to version 2026.2.17012 or later. This patch addresses the CSS injection flaw by implementing proper sanitization and escaping of CSS in Mermaid diagram rendering. Organizations should plan patching during a maintenance window, though the low severity allows for standard change control rather than emergency procedures.

Patch guidance

JetBrains has released YouTrack 2026.2.17012 and later versions containing the fix. Consult the JetBrains YouTrack release notes and security advisory for specific upgrade procedures. For on-premises installations, follow your organization's standard patch management workflow. Cloud-hosted instances may be automatically updated; verify your deployment status in the YouTrack administration console. Test the patch in a non-production environment if feasible to ensure diagram rendering functionality is not disrupted.

Detection guidance

Monitor YouTrack audit logs for diagram creation or modification events by users with unusual activity patterns. Search audit trails for diagram content containing CSS keywords (e.g., 'style', 'javascript:', 'onload') in Mermaid definitions. Review browser developer tools (F12) when viewing suspect diagrams to identify injected CSS rules. Implement Content Security Policy (CSP) headers if not already in place to mitigate CSS injection impact. Consider restricting who can create or edit diagrams in YouTrack's permission model as a compensating control.

Why prioritize this

This vulnerability merits standard priority patching rather than emergency treatment. The CVSS 3.5 score reflects the combination of network accessibility but mandatory authentication, user interaction, and integrity-only impact. No exploit has been added to the CISA Known Exploited Vulnerabilities catalog. Prioritize this alongside other routine security updates, but do not defer indefinitely—insider threats or compromised accounts could weaponize the flaw.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) yields a score of 3.5, rated LOW. Attack Vector is Network (YouTrack is typically web-accessible), but Privileges Required (PR:L) and User Interaction (UI:R) are mandatory, significantly reducing real-world attack surface. Confidentiality impact is None, and Availability impact is None; only Integrity is affected and only minimally (visual presentation). This score appropriately reflects a localized, low-impact defacement risk rather than a critical system compromise.

Frequently asked questions