A code injection vulnerability in JetBrains TeamCity allows authenticated attackers to achieve remote code execution, posing a significant risk to build infrastructure integrity.

This vulnerability involves improper control of generation of code (CWE-94), which can be triggered by an attacker with low privileges. The vulnerability requires authenticated access to the TeamCity instance to perform malicious actions.

Successful exploitation allows an attacker to execute arbitrary code within the context of the TeamCity server. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full system compromise, unauthorized access to sensitive build artifacts, and potential lateral movement into the development pipeline.

Immediate Action: Update JetBrains TeamCity to version 2026.1.2, 2025.11.6, or the latest available release provided by the vendor.

Proactive Monitoring: Review TeamCity server access logs for suspicious activity, particularly requests involving configuration changes or unexpected script execution.

Compensating Controls: Restrict network access to the TeamCity interface to trusted IP ranges and ensure the service runs with the minimum necessary privileges to limit the impact of a potential breach.

Public Exploit Available: No (exploit_available: unknown)

The high CVSS score of 8.8 underscores the urgency of addressing this vulnerability. Administrators should prioritize patching their TeamCity instances immediately to prevent unauthorized code execution and maintain the integrity of their software development life cycle.