JetBrainsCVE-2026-59794

JetBrains TeamCity: cross-site scripting

High7.3CVE-2026-59794 · Published Jul 10, 2026

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

JetBrains advisory

Affected versions

Package	Affected	Fixed in
TeamCity Product	< 2026.1.2	2026.1.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Jul 10	JetBrains YouTrack: cross-site scripting Low3.5Jul 10 CVE-2026-614922026.2.17394	Low3.5	2026.2.17394
Jul 10	JetBrains YouTrack: clickjacking Low3.5Jul 10 CVE-2026-597912026.2.17012	Low3.5	2026.2.17012
Jul 10	JetBrains IntelliJ IDEA: code execution via path traversal Critical9.6Jul 10 CVE-2026-597922026.1.4+1 more	Critical9.6	2026.1.4+1 more
Jul 10	In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via... High8.8Jul 10 CVE-2026-597932026.1.2	High8.8	2026.1.2
Jul 10	JetBrains TeamCity: cross-site scripting High8.1Jul 10 CVE-2026-597952026.1.2	High8.1	2026.1.2
Jul 10	JetBrains TeamCity: insecure permissions High8.1Jul 10 CVE-2026-597962026.1.2	High8.1	2026.1.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.