A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
jetbrains youtrack