JetBrains has disclosed a security vulnerability (CVE-2026-33392) in YouTrack affecting all versions before 2025.3.132953. The issue, a sandbox bypass enabling code execution, was reported by a security researcher in March 2026 and patched within 48 hours. YouTrack Cloud has already been updated and no evidence of exploitation was found. YouTrack Server administrators running versions older than 2025.3.132953 are advised to upgrade immediately. The vulnerability required administrator-level permissions to exploit and, on Cloud, could allow bypassing cross-tenant isolation boundaries.
Table of contents
Action required from YouTrack Server administratorsThe vulnerability: summaryMitigationSecurity bulletinFrequently asked questionsSupportSort: