← Back

CVE-2026-106218

nvd nist
Published: Oct 6, 2026Modified: Oct 8, 2026

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 6.0
Source: NVD

Description

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

Affected (2)

Products: Jetbrains: Teamcity
Jetbrains
1 product
Teamcity
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Jetbrains
Teamcity
version < 2025.11.7
Teamcity
2026.1.1 ≤ version < 2026.1.3

Related CWEs

CWE-184
Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (1)

Source: cve@jetbrains.com
Vendor Advisory

Timeline

No history available yet.