CVE-2026-111095 in TeamCity
Summary
by MITRE • 10/15/2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as a Stored Cross-Site Scripting (XSS) flaw within JetBrains TeamCity prior to versions 2026.2 and 2026.1.4, specifically affecting version 2025.11.8, represents a significant security risk for organizations relying on this continuous integration and deployment platform. This vulnerability resides in the classic project overview interface, where user-supplied input is not adequately sanitized before being stored in the backend database and subsequently rendered to other users without proper encoding or validation. Unlike reflected XSS attacks that require tricking a victim into clicking a malicious link, stored XSS persists on the server side, meaning the malicious script payload remains active until it is manually removed from the system. This persistence allows an attacker with write access to project data to inject executable JavaScript code that will automatically execute in the browsers of any administrator or user who views the compromised project overview page.
From a technical perspective, this flaw aligns closely with CWE-79, which categorizes improper neutralization of input during web page generation as Cross-site Scripting. The root cause typically involves insufficient output encoding when rendering dynamic content within HTML contexts. In the case of TeamCity's classic project overview, fields such as project descriptions, build configuration names, or custom parameters likely accepted raw script tags or event handlers like onload or onerror without stripping them out or escaping special characters. When these values are retrieved and displayed in a web browser, the client-side interpreter executes the injected code within the context of the TeamCity domain. This bypasses same-origin policy protections because the malicious script runs as if it were part of the legitimate application itself, granting it full access to cookies, session tokens, local storage, and other sensitive data associated with that origin.
The operational impact of this vulnerability is severe due to its potential for widespread compromise within an organization's development infrastructure. An attacker who successfully exploits this flaw can perform actions on behalf of authenticated users, including viewing sensitive build logs, accessing source code repositories linked in the project configuration, or modifying build settings to introduce malicious artifacts into the CI/CD pipeline. This creates a direct path for supply chain attacks where compromised builds could distribute malware to downstream systems. Furthermore, because TeamCity often holds administrative privileges and access to internal networks, an attacker can leverage the stolen session cookies of high-privilege users to escalate their own permissions, potentially gaining full control over the build server environment. The ability to execute arbitrary JavaScript also facilitates phishing attacks against other team members by displaying fake login prompts or warning dialogs that mimic legitimate TeamCity interfaces, thereby harvesting additional credentials.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is upgrading JetBrains TeamCity to version 2026.2 or later, where the vendor has implemented fixes for this input validation deficiency. For environments unable to upgrade immediately due to compatibility constraints with legacy plugins or workflows, compensating controls should be enforced at the network perimeter. Web Application Firewalls (WAFs) can be configured with rulesets specifically tuned to detect and block common XSS payloads in HTTP request parameters related to project overview fields. Additionally, administrators should review access control policies to ensure that only trusted personnel have write permissions for project configurations, thereby reducing the attack surface available to potential insiders or compromised accounts. From a development standpoint, enforcing strict output encoding using context-aware libraries is essential to prevent similar vulnerabilities in future updates. Security teams should also monitor user activity logs for anomalous behavior indicative of session hijacking or unauthorized configuration changes following any known exposure window.
This incident underscores the critical importance of secure coding practices within enterprise-grade DevOps tools that handle sensitive intellectual property and operational data. The persistence of stored XSS highlights how a single unchecked input field can serve as an entry point for comprehensive system compromise. By aligning remediation efforts with industry standards such as OWASP Top 10, specifically addressing Injection flaws through rigorous input validation and output encoding, organizations can significantly reduce their risk profile. Continuous monitoring and regular patch management remain the most effective defenses against evolving threats targeting CI/CD platforms like TeamCity.