Executive brief
JetBrains TeamCity, a platform used by software developers to automate the building and testing of code, was found to have a security flaw on its repository download page. This vulnerability could allow an attacker to trick a user into executing malicious scripts in their browser by clicking a specially crafted link. If successful, an attacker could potentially steal session information or perform actions on behalf of the user within the TeamCity interface.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in JetBrains TeamCity before versions 2026.1 and 2025.11.5. The flaw is located on the repository download page, where user-supplied input is improperly neutralized before being rendered in the web page (CWE-79). An unauthenticated remote attacker can exploit this by enticing a user to visit a malicious URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized actions. The issue has been addressed in the 2026.1 and 2025.11.5 releases.
Affected products
- JetBrains TeamCity Before 2026.1, 2025.11.5
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory