In JetBrains YouTrack before version 2025.2.92387, a stored XSS vulnerability was identified that could be exploited through Mermaid diagram content. This vulnerability allows attackers to execute arbitrary scripts in the context of a user’s session. The issue is particularly concerning due to its high severity and potential impact on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-57731 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious Mermaid diagram and convince a user to interact with it. This could be done through social engineering tactics, such as sending a link to a compromised YouTrack instance. Once the user interacts with the diagram, the attacker’s script could execute in the user’s browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- YouTrack: A project management and issue tracking tool that allows users to create and manage tasks and projects.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of JetBrains YouTrack, specifically version 2025.2.92387 or later. Additionally, implementing input validation and sanitization for user-generated content can help prevent similar XSS vulnerabilities in the future.