CVE-2025-68165: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-68165 is a reflected Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity affecting all versions before 2025.11, specifically in the VCS Root setup page. The vulnerability was published on December 16, 2025, with JetBrains as the assigning authority. It carries a CVSS v3.1 base score of 6.1 (Medium), requiring no privileges but necessitating user interaction to exploit (Red Hat Advisory, JetBrains Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the reflected type. An attacker can craft a malicious URL targeting the VCS Root setup page in TeamCity that, when visited by an authenticated user, causes unsanitized input to be reflected back and executed as a script in the victim's browser. No authentication is required on the attacker's side, but the attack requires the victim to interact with a crafted link. No public technical write-up or proof-of-concept code has been identified at this time (Red Hat Advisory, JetBrains Advisory).

Successful exploitation could allow an attacker to steal session cookies or administrative credentials from a logged-in TeamCity user, execute arbitrary scripts in the context of the victim's browser session, and potentially perform unauthorized actions within the TeamCity interface on behalf of the victim. Given TeamCity's role as a CI/CD platform with access to source code repositories, build pipelines, and deployment credentials, compromise of an administrative session could have significant downstream consequences including supply chain risk (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.158%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures are available via Nessus (plugin 279408) and Qualys (detection ID 530766) (Tenable Nessus, Red Hat Advisory).

1. Reconnaissance: Identify publicly accessible JetBrains TeamCity instances running versions prior to 2025.11 using tools like Shodan or Censys, or target known internal deployments.
2. Craft malicious URL: Construct a URL pointing to the VCS Root setup page in TeamCity that includes a reflected XSS payload in a vulnerable query parameter (e.g., injecting <script> tags or event handlers into an unsanitized input field).
3. Deliver the payload: Send the crafted URL to a target user (e.g., a TeamCity administrator) via phishing email, chat message, or other social engineering vector, inducing them to click the link while authenticated to TeamCity.
4. Script execution: When the victim loads the URL in their browser, the malicious script executes in the context of the TeamCity application, potentially exfiltrating session cookies, performing actions on behalf of the user, or redirecting to attacker-controlled infrastructure (Red Hat Advisory, JetBrains Advisory).

• Network: Outbound requests from a user's browser to unexpected external domains shortly after accessing TeamCity VCS Root setup pages; unusual HTTP GET requests to TeamCity VCS Root setup endpoints containing encoded script tags or JavaScript event handlers in URL parameters.
• Logs: TeamCity access logs showing requests to VCS Root setup pages with anomalous or encoded query strings (e.g., %3Cscript%3E, javascript:, onerror=, onload=).
• Session/Auth: Unexpected session activity or administrative actions performed from unusual IP addresses or at unusual times following a user's interaction with a suspicious link.

JetBrains has addressed this vulnerability in TeamCity version 2025.11. Organizations should upgrade to version 2025.11 or later as the primary remediation. As interim measures, administrators should implement a Content Security Policy (CSP) to restrict script execution, enforce strict input validation, and educate users about phishing and suspicious links. Monitoring administrative access logs for anomalous session activity is also recommended (JetBrains Advisory).

The vulnerability received standard coverage from vulnerability tracking platforms including Tenable (Nessus plugin 279408), Qualys, and Red Hat's CVE advisory page. Check Point also published a defense advisory (CPAI-2025-13942). No notable researcher commentary or significant social media discussion has been identified beyond routine CVE publication and scanner updates (Tenable Nessus, Red Hat Advisory, Check Point Advisory).