Stored XSS Vulnerability in JetBrains TeamCity by JetBrains
CVE-2026-111096

6.7MEDIUM

Key Information:

Vendor

Jetbrains
Status
Teamcity
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111096?

A vulnerability in JetBrains TeamCity affects versions prior to 2026.2, including 2026.1.4 and 2025.11.8. This vulnerability allows for stored Cross-Site Scripting (XSS) attacks through the classic build log feature, potentially enabling attackers to inject malicious scripts that can execute in the context of victims' browsers. Users of affected versions are encouraged to update to the latest release to mitigate this security risk and enhance their system's protection.

Affected Version(s)

TeamCity 0 < 2026.2, 2026.1.4, 2025.11.8

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.