In JetBrains YouTrack before version 2025.2.92387, a stored XSS vulnerability was identified that could be exploited via Mermaid diagram content. This vulnerability poses significant risks to user data and application integrity. Users are advised to update to the latest version to mitigate these risks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-57731 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious Mermaid diagram and convince a user to interact with it. Once the user views the diagram, the stored XSS payload can execute in the context of the user’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- JetBrains YouTrack: A project management tool that allows teams to track issues and manage projects effectively. The vulnerability affects all versions prior to 2025.2.92387.
Mitigation
To mitigate this vulnerability, users should upgrade to JetBrains YouTrack version 2025.2.92387 or later. Additionally, implementing input validation and sanitization for user-generated content can help prevent similar vulnerabilities in the future.