CVE-2026-123325PATCHED

jetbrains · youtrack

CVE-2026-123325: In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible

Description

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

Affected Products

Vendor	Product	Versions
jetbrains	youtrack	0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
jetbrains	jetbrains you track	cert_advisory	90%

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Related News (2 articles)

Tier B

BSI Advisories12h ago

[NEU] [hoch] JetBrains You Track: Mehrere Schwachstellen

→ No new info (linked only)

Tier C

VulDB15h ago

CVE-2026-123325 | JetBrains YouTrack prior 2025.3.170763/2026.1.14150/2026.2.19656 Plugin Sandbox code injection

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.17.1 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

2025.3.1707632026.1.141502026.2.19656

CWECWE-829

PublishedNov 6, 2026

Last enriched14h agov2

Trending Score42

Source articles3

Independent2

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-123327

CVE-2026-123327: In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue

Trending: 47

HIGHCVE-2026-123302

CVE-2026-123302: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted p

Trending: 42

HIGHCVE-2026-123305

CVE-2026-123305: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote

Trending: 42

HIGHCVE-2026-123304

CVE-2026-123304: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

Trending: 42

HIGHCVE-2026-123276

CVE-2026-123276: In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug pr

Trending: 42

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Nov 6, 2026

Discovered by ZDM

Nov 6, 2026

Updated: severity, cweIds

Nov 6, 2026

Patch Available

Nov 6, 2026

Version History

Last enriched 14h ago

v2Tier C14h ago

Severity upgraded from HIGH to CRITICAL and CWE changed from CWE-829 (Untrusted Search Path) to CWE-94 (Improper Control of Generation of Code)

severitycweIds

via VulDB

v115h ago

Initial creation