EUVD-2026-42912
GHSA-5526-463r-44x5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attacker needs agent access (PR:L) and an admin must view the page (UI:R); script crosses into the browser context (S:C) with limited confidentiality/integrity impact typical of stored XSS (C:L/I:L).
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
AnalysisAI
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an attacker who controls a build agent persist a malicious script into agent-reported data that executes when a privileged user opens the cloud profile page. Because it fires in the browser session of an operator with access to CI/CD configuration, it can lead to session/token theft and actions performed as the victim. The issue was reported by JetBrains itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
TeamCity is a JetBrains continuous-integration and build-management server that orchestrates build agents; agents connect to the server and report status/metadata that is rendered in the web UI. The flaw is CWE-79 (improper neutralization of input during web page generation): data reported by an agent is stored and later reflected without adequate output encoding on the cloud profile administration page, so attacker-controlled content is interpreted as active HTML/JavaScript in the viewer's browser. The affected component per CPE is cpe:2.3:a:jetbrains:teamcity (all versions prior to the fixed 2026.1.2 release); the injection sink is server-side stored data rendered in the cloud-profile admin view.
RemediationAI
Vendor-released patch: upgrade to JetBrains TeamCity 2026.1.2 or later, which is the primary and definitive fix (see https://www.jetbrains.com/privacy-security/issues-fixed/). If immediate upgrade is not possible, reduce exposure by tightening agent authorization so only vetted, trusted agents can connect and report data (Administration > Agents > unauthorized agents), since the payload originates from agent-reported data; the trade-off is added operational overhead when provisioning new agents. Additionally, restrict access to the cloud profile administration page to a minimal set of administrators and avoid viewing cloud profile pages on servers with unauthorized/unknown agents until patched, accepting that this delays cloud-agent configuration work. These are compensating controls only - patching to 2026.1.2 remains the correct remediation.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today