CVE-2025-26493: JetBrains TeamCity XSS Vulnerability

CVE-2025-26493 Overview

CVE-2025-26493 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting JetBrains TeamCity versions prior to 2024.12.2. The flaw resides in the Code Inspection Report tab, where multiple injection points allow attacker-controlled content to be rendered as executable script in the browser context. Exploitation requires user interaction, such as loading a crafted report or clicking a specially prepared link. Successful exploitation can lead to session token theft, unauthorized actions in the TeamCity web UI, and pivoting into CI/CD pipelines. The issue is tracked under [CWE-79] and was disclosed through the JetBrains security advisory process.

Critical Impact
A successful XSS in TeamCity can expose build pipelines, source code, and deployment credentials by hijacking authenticated user sessions.

Affected Products

JetBrains TeamCity versions prior to 2024.12.2
On-premises TeamCity servers exposing the Code Inspection Report tab
CI/CD environments with authenticated users accessing inspection results

Discovery Timeline

2025-02-11 - CVE-2025-26493 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26493

Vulnerability Analysis

The vulnerability is a client-side DOM-based XSS affecting the Code Inspection Report tab within the TeamCity web interface. TeamCity is a build management and continuous integration server used to automate software delivery. The Code Inspection Report presents static analysis results, including issue descriptions, file paths, and source snippets pulled from build artifacts.

Because the report renders data supplied by build inputs and inspection metadata, an attacker able to influence those inputs can inject payloads that execute in the browser of any user viewing the report. The scope changes from the vulnerable page to other resources, allowing the payload to interact with authenticated TeamCity endpoints on behalf of the victim. This vulnerability falls under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is unsafe handling of untrusted data on the client side. Values consumed by the Code Inspection Report tab are written into the DOM without proper contextual output encoding or sanitization, allowing HTML and script content in inspection payloads to be interpreted as executable markup rather than inert text.

Attack Vector

An attacker with the ability to influence inspection report content, such as through a pull request, a compromised build configuration, or a crafted project file, injects a JavaScript payload into a field rendered by the report tab. When a TeamCity user views the report, the browser executes the payload under the TeamCity origin, enabling session token exfiltration, CSRF-like actions against build APIs, and modification of build configurations. The Exploit Prediction Scoring System places this issue at a low predicted probability of exploitation, but authenticated CI/CD systems remain high-value targets.

No verified public proof-of-concept code is available. Refer to the JetBrains Security Issues Fixed advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-26493

Indicators of Compromise

Unexpected outbound requests from browsers of TeamCity users to attacker-controlled domains shortly after opening the Code Inspection Report tab
TeamCity audit log entries showing configuration or permission changes performed by users who only viewed inspection reports
Inspection report artifacts containing HTML tags, <script> elements, or JavaScript URI schemes in issue descriptions or file metadata

Detection Strategies

Inspect stored inspection report artifacts for embedded HTML or JavaScript payloads before rendering in the UI
Monitor TeamCity access logs for anomalous API calls originating from user sessions immediately after report views
Alert on TeamCity server versions below 2024.12.2 discovered during asset inventory scans

Monitoring Recommendations

Enable and centralize TeamCity audit logging, forwarding events to a SIEM for correlation with browser telemetry
Track authentication token issuance and reuse patterns to identify session hijacking attempts
Baseline normal user activity within the TeamCity UI and flag deviations that follow report tab access

How to Mitigate CVE-2025-26493

Immediate Actions Required

Upgrade all TeamCity servers to version 2024.12.2 or later without delay
Restrict access to the TeamCity web UI to trusted networks and authenticated users only
Review recent changes to build configurations, projects, and user permissions for signs of unauthorized modification

Patch Information

JetBrains has addressed CVE-2025-26493 in TeamCity 2024.12.2. Administrators should follow the upgrade guidance published in the JetBrains Security Issues Fixed advisory. After upgrading, verify the build number and confirm the Code Inspection Report tab renders inspection data as inert text.

Workarounds

Limit which users can view the Code Inspection Report tab until the upgrade is applied
Enforce a strict Content Security Policy at the reverse proxy in front of TeamCity to reduce the impact of injected script
Disable or restrict pull requests and external contributions that can influence inspection metadata on high-value projects

bash

# Verify installed TeamCity version on the server
cat /opt/TeamCity/webapps/ROOT/WEB-INF/DevPackage/version.txt

# Example nginx reverse proxy CSP header to reduce XSS blast radius
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;