JetBrains TeamCity versions prior to 2026.2 contained a stored cross‑site scripting flaw in the classic build log, allowing attackers to inject malicious scripts that run in the browser context of any user who views the affected log. Because the payload is stored, the vulnerability can repeatedly target multiple users and potentially hijack sessions, steal credentials, or deface pages, all of which represent client‑side integrity and confidentiality risks under CWE‑79.

The affected product is JetBrains TeamCity. All releases before 2026.2 are vulnerable, including the 2026.1.4 and 2025.11.8 builds.

The CVSS score of 6.7 classifies the issue as medium severity. The EPSS score of less than 1 % indicates a very low probability of exploitation at the time of this analysis, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no known active exploits. Likely exploitation would require an authenticated user to create or view build logs that contain malicious input; the attacker would need to inject script‑laden output into the log, which then executes for any subsequent viewer.