CVE-2026-100254
Jetbrains Teamcity: OS command injection
- Risk score
- 61/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
- Affected
- Jetbrains Teamcity before 2026.2, 2026.1.4, 2025.11.8
- Fix
- Upgrade Jetbrains Teamcity to 2026.2, 2026.1.4 or 2025.11.8 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
Last activity 30 Sep 2026. Patch Forecast updates every hour.