SecuriTricks - CVE-2026-33392

Description

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

Product(s) Impacted

Vendor	Product	Versions
Jetbrains	Youtrack	<2025.3.131383

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	jetbrains	youtrack	<2025.3.131383	/	/	/	/	/	/	/

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS Score

7.2 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: HIGH
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: April 17, 2026, 8:16 a.m.
Last Modified: April 17, 2026, 3:13 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-33392