EUVD-2026-33379
GHSA-jjhv-75hw-cg7g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-reachable reflected XSS needing a victim click (UI:R) with browser-context scope change (S:C); confidentiality/integrity limited to the victim's session, so C:L/I:L rather than C:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
AnalysisAI
Reflected cross-site scripting in JetBrains TeamCity before 2026.1.1 allows an attacker to inject arbitrary script into a victim's browser via the keyword filter parameter, executing in the context of the TeamCity web UI. Because TeamCity is a CI/CD orchestration server holding build secrets and privileged sessions, a tricked authenticated user (e.g. an administrator) clicking a crafted link can have their session or sensitive data compromised. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%).
Technical ContextAI
TeamCity is JetBrains' continuous integration and build management server, exposing a web application for configuring build pipelines, viewing logs, and managing users. The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: user-supplied input to the keyword filter feature is echoed back into an HTML response without adequate output encoding, so an attacker-controlled string is parsed as active script by the browser. The affected component is the search/filter functionality of the TeamCity UI (CPE cpe:2.3:a:jetbrains:teamcity:*). Reflected XSS is non-persistent - the payload lives in the request/link rather than being stored server-side - so exploitation depends on delivering the crafted URL to a logged-in user.
RemediationAI
Upgrade to JetBrains TeamCity 2026.1.1 or later, which contains the fix (Vendor-released patch: 2026.1.1); consult the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the specific build. Until you can upgrade, reduce exposure by restricting network access to the TeamCity web UI to trusted networks/VPN so attacker-delivered links cannot reach the application from the internet, and instruct users - especially administrators - not to follow untrusted links into the TeamCity interface, since exploitation requires a logged-in victim to open a crafted URL. A web application firewall rule that filters script-like payloads in filter/query parameters can serve as a stopgap, with the trade-off that filter rules may produce false positives on legitimate searches and are not a substitute for the patch. A strict Content-Security-Policy on the TeamCity host, if configurable in your deployment, would further limit inline script execution.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today