JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 stored user‑supplied data in the classic project overview page without proper escaping, allowing an attacker to inject executable script. The flaw qualifies as stored XSS, which can lead to information leakage, session hijacking, defacement, or the execution of malicious code in the context of any user who views the page.

The vulnerability affects JetBrains TeamCity. Systems running TeamCity versions before 2026.2, 2026.1.4, or 2025.11.8 are vulnerable; upgrading to 2026.2 or later resolves the issue.

The CVSS score of 8 indicates high severity, but the EPSS score of < 1% suggests that, at present, exploitations are rare. The flaw is not listed in the CISA KEV catalog. Attackers must deliver malicious input that is stored in the project overview; the impact is limited to users who view the page, but those users could be administrators or other privileged members. The attack likely requires authenticated access to create or modify the stored content that becomes part of the classic overview.