CVE Feed

    Dashboard / CVE / CVE-2026-100254

    CVE-2026-100254

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

    Published:Sep 30, 2026
    Last Modified:Oct 6, 2026
    EPS:Sep 30, 2026
    EPSS Score:0.00461
    CVSS Score:8.8

    Affected Products

    Vendor
    Jetbrains
    Product
    Teamcity

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-111096 (CVSS 6.7) — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible…
    CVE-2026-111095 (CVSS 8) — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was poss…
    CVE-2026-111094 (CVSS 8.1) — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the…
    CVE-2026-106219 (CVSS 6.5) — In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositor…
    CVE-2026-106218 (CVSS 8.8) — In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was pos…
    CVE-2026-100255 (CVSS 8.1) — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pas…
    CVE-2026-100253 (CVSS 8.8) — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possib…
    CVE-2026-63077 (CVSS 9.8) — In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the ag…
    CVE-2026-65907 (CVSS 9.1) — In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible…
    CVE-2026-65906 (CVSS 8.8) — In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High