CVE Intelligence
Analysis AI-assisted

CVE-2026-57926: JetBrains YouTrack Prototype Pollution in websandbox Bridge

CVE-2026-57926 is a prototype pollution weakness (CWE-1321) in the websandbox bridge of JetBrains YouTrack before 2026.2.16593. NVD rates it critical with a CVSS 3.1 base score of 9.8, while the CNA lists a separate score of 2.6. No confirmed exploitation appears in the sources consulted, and the record shows no fixed-version entry, so the vendor advisory should be checked directly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-57926 affects JetBrains YouTrack versions before 2026.2.16593. The record describes a prototype pollution weakness (CWE-1321) in the websandbox bridge component.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA (JetBrains) lists a different score of 2.6 under the same CVSS 3.1 version. The discrepancy should be reviewed against the vendor advisory.
  • The record does not detail the concrete effects of exploitation.

Affected products and versions

  • JetBrains YouTrack, versions before 2026.2.16593.
  • The record does not list other version ranges or configuration conditions.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Inventory YouTrack instances and confirm their running version.
  • Upgrade to 2026.2.16593 or later, which is the boundary indicated by the affected range. Check the JetBrains issues fixed page for vendor guidance.
  • Until patching is complete, restrict access to YouTrack to trusted networks where operationally feasible. This is a general defensive recommendation, not a vendor-specified measure.

Detection guidance

  • Track the YouTrack version across the estate and flag instances below the fixed boundary.
  • Review web and application logs for unusual activity against YouTrack web components and correlate it with authentication events, at a high level.

Limitations of the available information

The record has no English title, no entry in the fixes list, no EPSS score and no SSVC data. Details from the vendor advisory beyond the version boundary were not available in the record.

Frequently asked questions

Which JetBrains YouTrack versions are affected by CVE-2026-57926?

The record lists YouTrack versions before 2026.2.16593 as affected.

Is CVE-2026-57926 known to be exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Why are there two CVSS scores for this CVE?

NVD lists a base score of 9.8, while the CNA JetBrains lists 2.6 under CVSS 3.1. The record does not explain the difference, so the vendor advisory should be checked.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.