EUVD-2026-93504
GHSA-p8v4-6cfg-7hh7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Sandbox escape presupposes ability to submit Kotlin DSL (project-edit or VCS access), so PR:L not PR:N; low-complexity network vector, and the escape to the server process is a scope change with total impact.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
AnalysisAI
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to supply or alter a Kotlin DSL build configuration that TeamCity then evaluates - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are strongly conflicting and require careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed build: JetBrains TeamCity 2026.1.3 or 2025.11.7 (or the latest patch on your supported branch) - vendor-released patch available per JetBrains' fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all JetBrains TeamCity servers and identify instances running releases before 2026.1.3 or before 2025.11.7, confirm whether the Kotlin DSL/versioned settings feature is enabled, restrict project-administration/edit rights and VCS write access to trusted personnel, and apply the vendor-released patch (2026.1.3 or 2025.11.7, matching the applicable release branch) to any internet-facing or business-critical server; note the published CVSS vector is unauthenticated (PR:N), while the independent assessment and practical exploitation require project-edit/VCS write privileges (PR:L). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today