CVE-2026-100263

Executive Summary

CVE-2026-100263 is a stored HTML injection vulnerability in JetBrains YouTrack, an issue and project tracking platform, affecting versions prior to 2026.2.18991. The flaw allows an attacker to inject HTML markup that is persisted via the HTTP User-Agent header; the injected content is rendered to other users who view affected pages, requiring victim interaction. Impact is limited per the assigned CVSS score (4.7) with a scope change, indicating the vulnerable component can affect resources beyond its original security scope.

Technical Analysis

The NVD description states: "In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible." This is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly "Cross-site Scripting"). The specific variant here is described by the vendor/CNA as stored HTML injection, meaning attacker-controlled markup is persisted in application state and later rendered to other users without adequate output encoding.

The injection vector is the HTTP User-Agent request header. In YouTrack, the User-Agent value is commonly captured and surfaced in audit logs, activity feeds, session listings, or administrative views (e.g., active sessions, security/audit pages). Because the value is logged or stored, it becomes a persistent data source that is later re-rendered in a web context. The absence of proper contextual output encoding when that stored value is rendered into an HTML response is the root cause.

Key characteristics derived strictly from the provided data:

• Vulnerability class: Stored HTML injection (CWE-79 family).
• Injection point: User-Agent HTTP request header — an attacker-controllable, low-privilege input that requires no authenticated session at the point of injection in typical logging scenarios.
• Persistence: "stored," i.e., the malicious value survives beyond the immediate request.
• Rendering condition: Victim must view the page where the stored value is displayed (reflected in UI:R — User Interaction Required).
• Scope: S:C (Changed) — exploitation can affect resources beyond the vulnerable component's security authority, consistent with injected markup executing or rendering in a different origin/context.

The CVSS subscores — AV:N (network reachable), AC:L (no special conditions), PR:N (no privileges required to send the header), UI:R (victim must interact/view), S:C (scope change), C:L (limited confidentiality), I:N (no integrity impact recorded), A:N (no availability impact) — indicate a moderate-severity issue where the primary risk is limited information exposure or content manipulation rather than full script execution or data destruction within the vulnerable component.

No public proof-of-concept, Nuclei template, or exploit code is tracked in the supplied intelligence. No affected-version list, OSV package mapping, or vendor advisory URL was provided. Accordingly, code-level specifics (exact parameter names, controller/class names, or render endpoints) are not derivable from the source data and are deliberately not fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored HTML injection via a request header) and the constraints given in the CVSS vector.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable JetBrains YouTrack instance running a version below 2026.2.18991. Fingerprinting relies on the YouTrack login/portal page and product markers. No authentication is strictly required at the injection step because the User-Agent header is transmitted on ordinary requests.

2. Triggering the flaw (injection). The attacker crafts an HTTP request whose User-Agent header contains HTML markup (e.g., tags or attributes that will render as markup rather than inert text). Because the header is captured and stored by the application, the payload is persisted in whatever backend structure records client metadata (e.g., activity/audit records). This corresponds to the "stored" characteristic.

3. Payload/execution method (vulnerability-class level). When a victim later loads a YouTrack view that renders the previously stored User-Agent value, the application emits that value into an HTML response without correct contextual encoding. The browser then interprets the injected markup. Depending on what the markup can achieve given the S:C scope and C:L confidentiality rating, the practical outcome is content injection/defacement, UI redressing, or limited data exposure to the attacker. Full arbitrary script execution is not asserted here because the CVSS integrity and availability subscores are N, and the primary described impact is "HTML injection."

4. Post-exploitation impact. Persisted malicious markup can be delivered to any user who views the affected page, meaning a single injected header can affect multiple victims over time (classic stored-injection persistence). Given C:L, the realistic impact ceiling described by the scoring is limited information disclosure or content manipulation rather than account takeover or code execution in the vulnerable component.

Because the description does not specify the exact endpoint, log view, or rendering context, the precise victim-view is not identifiable from the source data.

Impact Assessment

• Affected systems: JetBrains YouTrack deployments running versions below 2026.2.18991. YouTrack is widely used for issue tracking, agile boards, and knowledge management, often deployed with broad internal access and sometimes internet-facing.
• Blast radius: Because the injection is stored and rendered to other users, a single malicious request can affect many users who subsequently view the affected page. The AV:N score confirms network exploitability; PR:N means no prior authentication/privilege is needed to inject the header.
• Confidentiality (C:L): Limited — consistent with modest information exposure or content manipulation rather than bulk data exfiltration.
• Integrity (I:N): No integrity impact is recorded in the assigned vector, so persistent modification of trusted data is not reflected in the score.
• Availability (A:N): No availability impact.
• Scope (S:C): Changed — the vulnerable component's exploitation can affect resources beyond its security scope, which raises the severity of an otherwise low-impact injection.
• Business impact: For organizations relying on YouTrack for ticketing and workflow, stored HTML injection can undermine trust in displayed data, enable phishing/UI-spoofing within the trusted application origin, and — where audit/session views are affected — potentially expose limited client metadata. Overall severity is Moderate (CVSS 4.7).

EPSS is not yet scored by FIRST.org; no probability-of-exploitation estimate is available. CVE is not in CISA KEV, and no in-the-wild exploitation is reported in the supplied data.

Detection Guidance

Sigma Rule

title: JetBrains YouTrack Stored HTML Injection via User-Agent Header
id: 7a6f1c2e-3b21-4f8a-9d5e-youtrack100263
status: experimental
description: Detects suspicious HTML/markup content in HTTP User-Agent headers targeting YouTrack, indicating attempted stored HTML injection (CVE-2026-100263).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100263
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: youtrack
detection:
  selection_ua:
    cs-user-agent|contains:
      - '<script'
      - '<img'
      - '<svg'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  selection_uri:
    cs-uri-stem|contains:
      - 'youtrack'
  condition: selection_ua and selection_uri
fields:
  - c-ip
  - cs-user-agent
  - cs-uri-stem
falsepositives:
  - Security scanners and fuzzing tools that emit markup in User-Agent
  - Legitimate bots with unusual UA strings
level: medium

YARA Rule

rule CVE_2026_100263_YouTrack_HTML_Injection_UA
{
    meta:
        description = "Detects HTML injection payloads targeting JetBrains YouTrack via the User-Agent header (CVE-2026-100263)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100263"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ua  = "User-Agent" nocase
        $u1  = "<script" nocase
        $u2  = "<svg" nocase
        $u3  = "<img" nocase
        $u4  = "onerror=" nocase
        $u5  = "onload=" nocase
        $u6  = "javascript:" nocase
        $yt  = "youtrack" nocase

    condition:
        $yt and $ua and any of ($u*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100263 JetBrains YouTrack Stored HTML Injection via User-Agent Header"; flow:established,to_server; http.header; content:"User-Agent|3a 20|"; nocase; pcre:"/User-Agent\x3a\s[^\r\n]*(<script|<svg|<img|onerror=|onload=|javascript:)/iH"; classtype:web-application-attack; reference:cve,2026-100263; sid:2026100263; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method == "GET" and
     user_agent.original : ("*<script*" or "*<svg*" or "*<img*" or "*onerror=*" or "*onload=*" or "*javascript:*")]

Splunk SPL Query

index=web sourcetype=youtrack* OR sourcetype=access_combined
| eval ua = lower(coalesce(useragent, cs_user_agent, cs_useragent, user_agent_header))
| where match(ua, "<script|<svg|<img|onerror=|onload=|javascript:")
| table _time, src_ip, clientip, host, uri, ua
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,youtrack,">
  <rule id="100263" level="10">
    <if_sid>31100,31101,31500</if_sid>
    <field name="user_agent">\.*(<script|<svg|<img|onerror=|onload=|javascript:).*</field>
    <description>CVE-2026-100263: Possible JetBrains YouTrack stored HTML injection attempt via User-Agent header</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_100263,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Confirm the deployed YouTrack version; any build prior to 2026.2.18991 is presumed affected per the NVD description.
   • Restrict network exposure of YouTrack administrative/audit/session views to trusted networks or authenticated administrators only, reducing the population of users who can trigger rendering of stored User-Agent values.
   • Where supported, deploy a WAF or reverse-proxy rule that rejects or sanitizes requests whose User-Agent header contains HTML markup (see the Suricata/Sigma signatures above). Note that blocking legitimate bot/scanner UAs may cause false positives and should be tuned.
   • Enable the detection rules in this report to capture attempted injection in server and access logs.

2. Patch/upgrade steps

   • Upgrade JetBrains YouTrack to 2026.2.18991 or later, which the NVD description identifies as the fixed version.
   • Validate the upgrade in a staging environment and verify that stored values are now output-encoded.
   • After upgrading, review existing stored client-metadata records (audit/activity/session data) for previously injected markup and purge them if the platform provides a mechanism to do so.
   • Because Patch Confidence is 0/4 and no vendor advisory URL or OSV package mapping was supplied, confirm the fixed build directly against JetBrains' official YouTrack release notes/changelog before and after upgrading.

3. Long-term hardening

   • Adopt contextual output encoding for all rendered client-supplied fields, especially logging of HTTP headers such as User-Agent; apply an HTML-escaping/encoding policy at the rendering layer.
   • Enforce a strict Content Security Policy (CSP) to reduce the impact of any residual markup injection.
   • Track YouTrack security advisories via a subscription to JetBrains' security bulletin channel and integrate CVE feeds into the vulnerability management workflow.
   • Regularly audit third-party-generated or logged metadata that flows into web views for injection exposure.

References

• NVD: CVE-2026-100263 — https://nvd.nist.gov/vuln/detail/CVE-2026-100263
• JetBrains YouTrack release/changelog (vendor): consult the official JetBrains YouTrack product downloads/changelog for build 2026.2.18991
• FIRST.org EPSS — no score yet assigned (per supplied data): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-100263 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-79 Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html

No threat actor campaigns or confirmed exploit-in-the-wild evidence are reported in the supplied data; no public PoC, Nuclei template, or exploit code is tracked.