JetBrains TeamCity EUVD-2026-102149

Exploitation requires an authenticated TeamCity account with sufficient permissions to inject content into build output that is rendered in the classic build log view (PR:L), plus a victim - typically another user or administrator - who subsequently opens that specific stored build log in a browser (UI:R). It affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8; instances already upgraded to those versions, or deployments where build-triggering access is tightly restricted to trusted users, are not realistically exploitable. The need for both prior authentication and victim interaction, combined with the vendor's AC:H rating, substantially limits opportunistic or automated exploitation.

This is a moderate-severity, authenticated stored XSS (CWE-79) in JetBrains TeamCity's classic build log, carrying a vendor CVSS of 6.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U). The vector itself tempers the raw score: exploitation requires an attacker who already holds a low-privileged authenticated account (PR:L), relies on victim interaction - a user must view the poisoned build log (UI:R) - and is rated high attack complexity (AC:H). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided intelligence, so there is no evidence of active exploitation or widespread automated weaponization; this reads as a defense-in-depth fix rather than an emergency. The vendor's C:H/I:H impact rating is notably aggressive for a scope-unchanged stored XSS and appears to assume script execution can lead to full session/action compromise of a privileged viewer; the S:U (scope unchanged) choice sits in tension with that, since classic XSS payloads execute in the victim's browser context, which many assessors treat as a scope change - verify impact assumptions with JetBrains. Bottom line: a genuine issue worth patching in CI/CD pipelines that handle sensitive build secrets, but not a drop-everything priority absent exploitation signals.

A low-privileged TeamCity user with the ability to influence build output injects a malicious script payload that is persistently stored in the classic build log. When a higher-privileged user or administrator later opens that build log in their browser, the stored script executes in their authenticated session, potentially hijacking their session token or performing actions on their behalf. No public exploit code is identified at time of analysis.