PT-2025-6219 · Jetbrains · Teamcity

Published 2025-02-11 · Updated 2025-12-29 · CVE-2025-26493

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.12.2

Description The issue concerns a DOM-based cross-site scripting (XSS) condition in the Code Inspection Report tab. This occurs due to insufficient protection of the web page structure. Exploitation could allow an attacker to execute malicious scripts in the context of a user's browser. The affected component is the Code Inspection Report tab. The vulnerability allows for multiple instances of DOM-based XSS.

Recommendations Versions prior to 2024.12.2 should be updated to version 2024.12.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-12845

CVE-2025-26493

Affected Products

Teamcity

References · 11

• https://osv.dev/vulnerability/CVE-2025-26493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26493 · Security Note
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12845 · Security Note
• https://t.me/CSIRT_italia/3019 · Telegram Post
• https://t.me/cvenotify/110790 · Telegram Post
• https://t.me/cvedetector/17709 · Telegram Post
• https://twitter.com/CVEnew/status/1889317087874584627 · Twitter Post
• https://t.me/CSIRT_italia/2966 · Telegram Post
• https://twitter.com/cybercronai/status/1889429295073825038 · Twitter Post
• https://t.me/cvenotify/122551 · Telegram Post