JetBrains TeamCity releases prior to 2026.2—including versions 2026.1.4 and 2025.11.8—contain a sandbox escape flaw that can be triggered by crafted versioned settings defined in Kotlin DSL scripts. This flaw permits an attacker to escape the restricted execution environment and run arbitrary code on the TeamCity server. The vulnerability maps to CWE-184, which denotes a flow divergence that can lead to unintended behavior.

Affected products include JetBrains TeamCity, specifically all releases before 2026.2, especially 2026.1.4 and 2025.11.8. The flaw is active whenever users load or edit Kotlin DSL configuration files that incorporate custom logic. Administrators managing these settings are therefore at risk if they allow untrusted input.

The CVSS score of 8.8 indicates critical severity. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, implying a lower documented exploitation rate, although the absence of EPSS should not be interpreted as low risk. The likely exploitation path requires malicious or tampered Kotlin DSL code, so attackers must have some level of access to the settings or the ability to supply a custom script to the server. If that condition is met, code execution on the TeamCity server can occur, enabling full compromise of the host.