EUVD-2026-48253
GHSA-rxg7-r9m5-jj25
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires project-admin rights to edit VCS roots (PR:H) but is network-reachable with no interaction; code execution escaping the config context to agents justifies S:C and full C/I/A:H.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
AnalysisAI
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Technical ContextAI
TeamCity is a continuous-integration and build-automation server that connects to source repositories through 'VCS roots' - configuration objects that define how the server checks out code (URL, branch, authentication, and Git-specific parameters). CWE-94 (Improper Control of Generation of Code / Code Injection) here indicates that attacker-influenced Git VCS root parameters are interpreted as executable code rather than inert data, so the server or its build agents execute injected commands during VCS operations. The only CPE provided (cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*) is unbounded on version, so the affected range must be read from the advisory text (before 2026.1.2 in the 2026.1 line and before 2025.11.6 in the 2025.11 line). The scope change (S:C) in the CVSS vector is consistent with server-side configuration leading to execution in a distinct security context such as a build agent.
RemediationAI
Vendor-released patch: upgrade to TeamCity 2026.1.2 or 2025.11.6 (or later) depending on your release line; these are the fixed versions cited by JetBrains at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the upgrade is applied, reduce exposure by tightly restricting who holds project-administrator / VCS-root edit permissions, since PR:H means only privileged users can trigger the flaw - audit and remove unnecessary VCS-configuration rights and review recently created or modified Git VCS roots for suspicious parameters. As additional hardening, limit network access to the TeamCity server to trusted operators and isolate build agents so that a compromised agent cannot pivot into production; note that tightening VCS permissions may block legitimate project admins from self-service repository configuration, so coordinate with development teams before enforcing.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today