CVE-2025-52879: JetBrains TeamCity XSS Vulnerability

CVE-2025-52879 Overview

CVE-2025-52879 is a reflected cross-site scripting (XSS) vulnerability in JetBrains TeamCity affecting versions prior to 2025.03.3. The flaw resides in the NPM Registry integration component and allows an authenticated attacker with high privileges to inject client-side script content that executes in the browser of a victim who interacts with a crafted request. The issue is tracked under CWE-79 and requires user interaction to trigger. JetBrains addressed the defect in TeamCity 2025.03.3 as part of its ongoing security maintenance program.

Critical Impact
Successful exploitation permits script execution in an authenticated user's browser session, enabling potential session data theft, UI manipulation, and unauthorized actions performed on behalf of the victim within TeamCity.

Affected Products

JetBrains TeamCity versions before 2025.03.3
TeamCity deployments with NPM Registry integration enabled
On-premises TeamCity server installations

Discovery Timeline

2025-06-23 - CVE-2025-52879 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52879

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the NPM Registry integration feature of TeamCity. Reflected XSS occurs when user-supplied input is returned in an HTTP response without proper output encoding or sanitization. In this case, input reaching the NPM Registry integration endpoint is echoed back to the browser and rendered as executable script content.

Exploitation requires an authenticated user with high privileges to interact with a crafted link or request. The attack scope is changed, meaning code executed in the vulnerable component can affect resources beyond the initial security boundary. This is consistent with browser-executed script gaining access to other pages and cookies within the TeamCity origin.

The practical impact includes theft of session tokens, forced actions in the TeamCity UI, and manipulation of build configuration data visible to the victim. Because TeamCity manages build pipelines, secrets, and deployment credentials, script execution within an authenticated session can facilitate follow-on supply chain attacks.

Root Cause

The root cause is insufficient output encoding of user-controlled input processed by the NPM Registry integration. Values reflected into the response HTML are not neutralized against script contexts, permitting HTML and JavaScript payloads to render in the DOM.

Attack Vector

The attack is delivered over the network. An attacker with elevated privileges crafts a malicious URL or request targeting the NPM Registry integration and lures another authenticated user to interact with it. When the victim's browser loads the reflected content, the injected script executes under the TeamCity origin, granting access to authenticated session context.

No verified proof-of-concept code is publicly available. Refer to the JetBrains Fixed Security Issues advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-52879

Indicators of Compromise

Web server access logs showing unusual query parameters containing HTML tags, <script> fragments, or URL-encoded angle brackets (%3Cscript) directed at NPM Registry integration endpoints.
Outbound HTTP requests from user browsers to attacker-controlled domains shortly after a TeamCity session interaction.
Unexpected TeamCity API calls or configuration changes performed under a privileged user's session without corresponding UI actions.

Detection Strategies

Enable and review TeamCity audit logs for anomalous administrative actions correlated with NPM Registry integration usage.
Deploy a web application firewall (WAF) rule set targeting reflected XSS payload patterns on TeamCity endpoints.
Inspect referer headers and request parameters for encoded script payloads directed at the /npmRegistry path space.

Monitoring Recommendations

Alert on TeamCity administrator sessions that generate outbound requests to uncategorized or newly registered domains.
Monitor Content Security Policy (CSP) violation reports if CSP is configured in enforcement or report-only mode.
Track version compliance across TeamCity installations to confirm all servers run 2025.03.3 or later.

How to Mitigate CVE-2025-52879

Immediate Actions Required

Upgrade all TeamCity server instances to version 2025.03.3 or later as published in the JetBrains security advisory.
Audit accounts with privileges to configure the NPM Registry integration and remove unnecessary elevated access.
Rotate any credentials, tokens, or API keys that may have been exposed during authenticated sessions.

Patch Information

JetBrains released a fix in TeamCity 2025.03.3. Administrators should download the current release from the official JetBrains distribution channels and follow the standard upgrade procedure for on-premises TeamCity servers. Verify the installed build number after upgrade to confirm the patched version is active.

Workarounds

Restrict NPM Registry integration configuration to a minimal set of trusted administrators until the upgrade is complete.
Configure a strict Content Security Policy header for TeamCity to limit inline script execution and untrusted script sources.
Educate privileged users to avoid clicking untrusted links that reference TeamCity URLs while authenticated.

bash

# Verify TeamCity server version after patching
curl -s https://teamcity.example.com/app/rest/server | grep -oE 'version="[^"]+"'

# Example CSP header to add at the reverse proxy layer
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;