Authenticated users of JetBrains TeamCity can inject carriage‑return line‑feed characters into Pipeline Git connection settings. The injection allows arbitrary command execution on Windows servers, giving the attacker full control over the affected host. This flaw, a form of command injection (CWE‑78), can compromise confidentiality, integrity, and availability of the entire server.

The vulnerability affects JetBrains TeamCity versions released before 2026.2, before 2026.1.4, and before 2025.11.8. Users running any of these releases are at risk until they apply an update that removes the CRLF processing bug.

The CVSS score of 8.8 indicates high severity. No EPSS data is available, so the precise likelihood of exploitation is unknown, but the flaw is listed in the official JetBrains advisory and is not in the CISA KEV catalog. Attackers need authenticated access with permission to edit Pipeline Git connection settings; once that condition is met, they can execute arbitrary system commands on the Windows server.