CVE-2026-111095 Overview
CVE-2026-111095 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity. The flaw affects the classic project overview page in versions prior to 2026.2, 2026.1.4, and 2025.11.8. An authenticated attacker with low privileges can inject persistent script payloads that execute in the browsers of users who view the affected project overview. The weakness is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). JetBrains has addressed the issue in the fixed releases listed on the JetBrains Security Issues Fixed page.
Critical Impact
Stored XSS in the classic project overview enables an authenticated attacker to execute arbitrary JavaScript in the sessions of other TeamCity users, including project administrators.
Affected Products
- JetBrains TeamCity versions before 2025.11.8
- JetBrains TeamCity 2026.1.x versions before 2026.1.4
- JetBrains TeamCity 2026.2 pre-release builds prior to the fix
Discovery Timeline
- 2026-10-15 - CVE-2026-111095 published to the National Vulnerability Database
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-111095
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the classic project overview view of JetBrains TeamCity. User-controllable content rendered on that page is not properly neutralized before being written into the HTML response. An authenticated user who can supply project-related content can persist a malicious payload. The payload executes when another user, such as a developer or administrator, loads the classic project overview.
Exploitation requires low privileges and user interaction, and the attack crosses a security scope boundary because the injected script runs in another user's authenticated session. Successful exploitation can lead to session token theft, forced actions in the TeamCity web interface, modification of build configurations, or pivoting toward the continuous integration pipeline.
Root Cause
The root cause is improper output encoding of untrusted input rendered by the classic project overview page. Values that originate from authenticated users are inserted into HTML context without consistent escaping, allowing <script> tags or event handler attributes to be interpreted by the browser instead of displayed as text.
Attack Vector
The attack vector is network-based against the TeamCity web interface. An attacker who already holds a low-privilege account injects a malicious payload into a field reflected on the classic project overview. When a privileged user views that page, the browser executes the attacker-supplied script under the TeamCity origin. Because TeamCity brokers access to source code, artifacts, and deployment credentials, an attacker can abuse the executed script to escalate within the CI/CD environment.
No verified public proof-of-concept is available. See the JetBrains Security Issues Fixed advisory for additional technical context.
Detection Methods for CVE-2026-111095
Indicators of Compromise
- Project fields, descriptions, or overview content containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs.
- TeamCity audit log entries showing project metadata edits by unexpected low-privilege accounts shortly before administrators report anomalous browser behavior.
- Outbound HTTP requests from administrator browsers to unknown domains immediately after loading /project.html or the classic overview URL.
Detection Strategies
- Inspect the TeamCity database and project configuration XML for stored HTML or JavaScript content in project names, descriptions, and overview blocks.
- Enable and review TeamCity audit logs for unexpected modifications to project overview content by non-administrative users.
- Deploy a Content Security Policy (CSP) report-only header to surface inline script execution on TeamCity pages during triage.
Monitoring Recommendations
- Monitor web server access logs for requests to classic project overview endpoints that return response bodies containing script tags.
- Alert on administrator session activity that originates from unusual geolocations or user agents shortly after viewing project pages.
- Track changes to high-value TeamCity assets such as build steps, VCS roots, and connection tokens following any suspected XSS event.
How to Mitigate CVE-2026-111095
Immediate Actions Required
- Upgrade JetBrains TeamCity to 2025.11.8, 2026.1.4, 2026.2, or later as applicable to your release branch.
- Audit all project overview content for stored HTML or JavaScript and remove any unexpected markup.
- Rotate TeamCity user tokens, VCS credentials, and administrator passwords if exploitation is suspected.
Patch Information
JetBrains has released fixed versions 2025.11.8, 2026.1.4, and 2026.2 that properly neutralize user-supplied content on the classic project overview. Refer to the JetBrains Security Issues Fixed page for the full advisory and upgrade guidance.
Workarounds
- Restrict project edit permissions to trusted administrators until the server is patched.
- Prefer the modern Sakura UI project overview over the classic project overview where feasible, and limit routine use of the classic view.
- Enforce a strict Content Security Policy at a reverse proxy in front of TeamCity to block inline script execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
